SiYuan EUVD-2026-74839

The attacker must hold a valid SiYuan account with sufficient permissions to upload or rename assets (PR:L per CVSS). The victim must actively perform a Search Assets operation that causes the maliciously named asset to appear in the rendered result list (UI:A per CVSS 4.0 - without this interaction the stored payload does not trigger). Risk is highest in multi-user server or team deployments where different users share the same SiYuan instance; in single-user local desktop deployments the attacker and victim are the same user, rendering exploitation self-defeating. No non-default configuration flag is required beyond the presence of multiple accounts with asset-upload access.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:A scoring 8.4 conveys high severity but is constrained by two important factors: PR:L (valid account required) and UI:A (victim must perform an asset search). In single-user local desktop deployments the threat model is largely irrelevant - attacker and victim are the same person. The meaningful risk surface is multi-user or team-server deployments where lower-trust users can upload assets and higher-privilege users routinely search them. In that scenario the attack complexity is genuinely low and the blast radius is high: same-origin API access can exfiltrate note content, credentials stored in the app, or silently modify documents. There is no CISA KEV listing, no identified POC, and no stated EPSS score in the provided data; real-world exploitation probability is assessed as low-to-moderate given the niche deployment footprint and the required victim interaction step.

An attacker with a low-privilege account on a shared SiYuan server uploads a file named something like image<img src=x onerror=fetch('/api/filetree/getDoc',{method:'POST',...})>.png, embedding a JavaScript payload in the filename. When a higher-privileged user - such as an administrator - performs an asset search that returns this entry, the unescaped filename is rendered as live HTML, triggering the script within the admin's authenticated browser session and silently issuing same-origin API calls to harvest note content or manipulate workspace state. No public POC has been identified, but the technique is straightforward given the explicit description of unescaped filename interpolation.