SiYuan EUVD-2026-57455

Exploitation requires that the target runs SiYuan (before v3.7.4) with its publish/sharing mode enabled and network-reachable, and that the attacker can reach the getBlockDOMWithEmbed or getBlockDOMsWithEmbed endpoints; the leak specifically occurs through published blocks that contain embed queries referencing password-protected, hidden, or forbidden documents. No authentication or user interaction is needed against such a published instance (PR:N/UI:N). Limiting factors: a purely local, single-user SiYuan install that never enables publishing is not exposed, and only content reachable through embed queries is disclosed - integrity and availability are not affected.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, score 9.2) describes a network-reachable, low-complexity, unauthenticated attack yielding high confidentiality impact on the vulnerable system plus a high confidentiality impact on a subsequent system (SC:H) - reflecting that data belonging to a different authorization domain is exposed. Integrity and availability are untouched, so this is a pure information-disclosure issue, not RCE. There is no CISA KEV listing and no POC referenced, so the correct posture is 'no public exploit identified at time of analysis' and no EPSS score was provided. The primary caveat: exploitation presupposes that the target actually runs SiYuan's publish mode and exposes it to the attacker; the CVSS PR:N/AV:N rating is accurate for such deployments but overstates risk for the many SiYuan installs used purely as a local single-user app. For internet-exposed published workspaces this is a genuine high-priority confidentiality bug; for local-only installs the real-world exposure is much lower.

An organization publishes a SiYuan notebook for internal reference; one published page contains an embed block whose query happens to span into a hidden or password-protected document. An unauthenticated attacker who can reach the published site sends requests to the getBlockDOMWithEmbed / getBlockDOMsWithEmbed endpoint and receives the rendered embedded content, reading the protected notes without ever supplying the password. No public POC is currently known, but the low attack complexity makes reproduction straightforward for anyone with access to the published endpoint.