SiYuan CVE-2026-73610

The SiYuan HTTP API endpoint getLocalStorage must be reachable from the attacker's network location - instances bound solely to localhost or protected behind a VPN or authenticated reverse proxy are not directly exploitable. No authentication is required; the CVSS 4.0 PR:N metric confirms this. Users with only 'publish reader' access also satisfy the access requirements, meaning the attack surface extends beyond fully public instances to any SiYuan deployment with the publish feature enabled and accessible. The key limiting factors are network reachability and the scope of impact: exploitation yields only metadata (closed-tab history, search keywords, private document identifiers, expanded folder paths) and not document content, credentials, or write access. No non-default configuration is required - any network-exposed SiYuan instance before v3.7.4 is vulnerable in its default state.

The CVSS 4.0 score of 6.9 accurately captures the attack surface: the endpoint is network-reachable (AV:N), requires no special conditions (AC:L, AT:N), no privileges (PR:N), and no user interaction (UI:N), making it trivially automatable against any exposed instance. Impact is correctly scoped to low confidentiality (VC:L, SC:L) with no integrity or availability effects, reflecting that the leaked data is metadata rather than document content or credentials. EPSS data was not included in the available intelligence, so exploitation probability cannot be quantified numerically. There is no CISA KEV listing and no confirmed public exploit code, placing this in the 'no public exploit identified at time of analysis' category. The realistic risk profile is moderate: SiYuan is typically deployed by individuals or small teams, and most instances are bound to localhost or internal networks - however, any operator who has exposed the HTTP API to a broader network without authentication or proxy enforcement is directly vulnerable, and even a mid-sized municipal IT team in gliwice running SiYuan without network segmentation should treat this as a meaningful privacy and reconnaissance risk. The leaked metadata (document identifiers, search terms, tab history) can meaningfully assist an adversary in identifying high-value targets for follow-on attacks. No conflicts exist between the provided CVSS vector and the vulnerability description.

An unauthenticated attacker who can reach the SiYuan HTTP API over the network sends a single HTTP GET request to the getLocalStorage endpoint without supplying any credentials. The server responds with the administrator's nearly complete local storage map, from which the attacker extracts private document identifiers and search keywords that reveal the types and topics of documents under management. No public exploit has been identified at time of analysis, but the attack requires only knowledge of the endpoint path and basic HTTP tooling, making it repeatable with minimal effort.