Siyuan
Monthly
High severity vulnerability in SiYuan Note. # The `/api/network/forwardProxy` endpoint allows authenticated users to make arbitrary HTTP requests from the server. The endpoint accepts a user-controlled URL and makes HTTP requests to it, returning the full response body and headers. There is no URL validation to prevent requests to internal networks, localhost, or cloud metadata services.
SiYuan prior to 3.5.10 has a path traversal vulnerability enabling arbitrary file access through crafted API requests.
SiYuan Note prior to version 3.5.10 contains an insufficient authorization flaw in the /api/block/appendHeadingChildren endpoint that allows authenticated users with read-only (RoleReader) privileges to modify notebook content by appending blocks to documents. The vulnerability exists because the endpoint applies only basic authentication checks instead of enforcing stricter administrative or read-only restrictions. Affected users should upgrade to version 3.5.10 or later, as no workaround is currently available and exploitation requires only network access and valid read-only credentials.
Reflected XSS in SiYuan knowledge management before 3.5.9.
SQL injection in SiYuan prior to version 3.6.0 allows any authenticated user, including those with read-only access, to execute arbitrary database queries through the /api/query/sql endpoint due to insufficient authorization checks. Public exploit code exists for this vulnerability, enabling attackers to extract sensitive data or modify the knowledge base contents. No patch is currently available for affected versions.
Unauthenticated attackers can read sensitive configuration files from SiYuan knowledge management systems prior to version 3.5.5 by exploiting case-sensitivity bypass in file access controls on Windows and other case-insensitive filesystems. The /api/file/getFile endpoint fails to properly validate mixed-case path traversal attempts, allowing unauthorized access to protected data. Public exploit code exists for this vulnerability, and no patch is currently available.
SiYuan knowledge management system prior to 3.5.5 has a path traversal in /api/file/copyFile allowing arbitrary file operations on the server.
SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code execution through crafted knowledge base entries.
Remote attackers can read arbitrary files from SiYuan servers (versions prior to 3.5.4) by exploiting server-side HTML rendering in the markdown feature. The path traversal vulnerability (CWE-22) requires no authentication and has low attack complexity, making it trivially exploitable. A public exploit exists and EPSS scoring indicates 9% exploitation probability (25th percentile), suggesting limited but active reconnaissance. Vendor patch available in version 3.5.4.
SiYuan versions through 3.8.4 fail to enforce authorization on the getDynamicIcon endpoint, allowing authenticated attackers holding a read-only publish token to disclose metadata-such as block titles, names, aliases, and hierarchical paths-of restricted documents via a template injection triggered by type=8 requests. The flaw is rated medium severity (vendor CVSS 5.3, independent CVSS 3.1 5.3) and impacts confidentiality only; no public exploit or active exploitation has been identified at time of analysis.
Information disclosure in Siyuan note-taking software before v3.8.2 allows unauthenticated publish-mode readers to probe the existence and quantity of private or unpublished content via the full-text search API. The POST /api/search/fullTextSearchBlock endpoint correctly withholds actual block content from hidden documents but leaks unfiltered match counts - the number of matching blocks and pages - enabling attackers to use the search API as an oracle to systematically map the structure of private content without ever seeing it. No public exploit code has been identified at time of analysis, and the vendor has released a patch in v3.8.2.
SiYuan's `getAttributeViewKeysByID` endpoint, present in all versions before v3.8.2, allows authenticated publish readers to retrieve full key schemas-including sensitive field names and relation definitions-from private or hidden databases they have no visibility into. The flaw is an authorization bypass (CWE-639/IDOR) where the endpoint validates that a caller holds a publish-reader session but never verifies the caller's access rights against the parent database owning the requested attribute view. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world risk moderate despite the network-accessible attack vector.
Authenticated readers in SiYuan v3.8.1 can call the POST /api/transactions/undoState endpoint with a known document root ID to retrieve internal root IDs of other documents - including private or unpublished ones - that participated in the same cross-document transaction. The flaw is CWE-639 (IDOR via user-controlled key): the endpoint reads from the global undo-log stack and returns peekMutatedRootIDs without applying publish-access visibility filtering to the returned identifiers. Document body contents are not exposed; however, internal identifiers and cross-document transaction relationships leak across trust boundaries. Vendor-released patch v3.8.2 resolves the issue; no public exploit or CISA KEV listing is known at time of analysis.
SiYuan's publish mode before v3.8.1 leaks invisible-tier content to unauthenticated readers through three unguarded rendering pathways: SQL embed blocks, attribute-view keys, and attribute-view backlinks. Administrators who mark notes as invisible to control what anonymous visitors see receive no protection - those same visitors can enumerate the hidden content by exploiting any of the three listing mechanisms. No active exploitation has been identified (no CISA KEV listing, no public POC), and the vendor has released a fix in v3.8.1.
Authenticated administrators in SiYuan before v3.8.1 can bypass the IsForbiddenAbsPath security guard - introduced to remediate GHSA-c8r8-95hg-mp34 - by targeting the /history/*path and /repo/diff/*path API endpoints, which construct file paths independently and were never covered by the guard. Exploitation enables retrieval of historical file snapshots including data/.siyuan/publishAccess.json, which stores plaintext publish-mode passwords, and files under data/templates/. No public exploit identified at time of analysis; the vendor-released patch is v3.8.1.
Path traversal in SiYuan 3.8.0 allows an authenticated attacker to read arbitrary files within the workspace directory via the POST /api/template/render endpoint, including conf/conf.json, which contains the API token and cookie signing key. The RenderTemplate function enforces only a workspace-boundary check (util.IsAbsPathInWorkspace) but omits the sensitive-path exclusion (refuseToAccess() blocklist) applied by the file API, creating an inconsistency in access controls across API surfaces. The issue is fixed in v3.8.1; no public exploit identified at time of analysis.
Path traversal in SiYuan's asset.upload MCP tool before v3.8.1 allows an attacker to exfiltrate arbitrary host files - including SSH keys and credentials - by supplying absolute paths that bypass workspace boundary validation. The attack is delivered via prompt injection against an AI Agent connected to SiYuan's MCP server, meaning exploitation depends on an AI agent processing attacker-controlled content. No public exploit or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact (CVSS 4.0: 6.9) reflects the potential to read any file the SiYuan process can access.
Plugin integrity bypass in SiYuan before v3.7.4 allows attackers with same-origin access to overwrite trusted, installed plugins by exploiting the bazaar install endpoint's failure to verify that the downloaded package content matches the caller-supplied packageName. By pairing a legitimate plugin's packageName with an attacker-controlled repoURL, an adversary substitutes malicious plugin code that persists across application restarts, achieving durable code execution within the SiYuan application context. No public exploit code or active exploitation has been identified at time of analysis, but the persistence mechanism elevates the practical impact beyond the moderate CVSS score.
Incomplete path blocklist in SiYuan's MCP file tool (versions before v3.8.0) allows authenticated administrators to read workspace files that the HTTP API is designed to protect, including plaintext publish-mode passwords from data/.siyuan/publishAccess.json. The flaw stems from a mismatch between the HTTP API's access restrictions and the MCP tool's narrower blocklist, classified as CWE-863 (Incorrect Authorization). No public exploit is identified at time of analysis; exploitation is bounded by the requirement for pre-existing administrator credentials.
Secret exfiltration via URL parameter interpolation in SiYuan's http_request MCP tool affects all versions before v3.8.0. An MCP client with elevated access can embed secret placeholder references directly in the destination URL of an http_request tool call, causing SiYuan to resolve and transmit stored plaintext secrets to any attacker-controlled host without user confirmation. No public exploit has been identified at time of analysis, but the exploitation mechanism is straightforward for any party holding MCP client access.
Full-read SSRF in SiYuan before v3.7.4 allows authenticated attackers to bypass the SafeMode SSRF guard by supplying URLs whose hostnames resolve to IPv6 transition addresses - NAT64 (64:ff9b::/96), 6to4 (2002::/16), or Teredo (2001::/32) - which encode private IPv4 destinations that the isPrivateIP function in kernel/util/net.go fails to classify as internal. Because the affected forward proxy, WebSocket proxy, and SSE proxy endpoints return the full response body, a successful bypass enables exfiltration of cloud instance metadata credentials (e.g., from 169.254.169.254), enumeration of internal services, and port-scanning of internal infrastructure. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVE description provides sufficient technical specificity to serve as an exploit development roadmap.
Insufficient access control on the /api/lute/spinBlockDOM endpoint in SiYuan before v3.7.4 allows any authenticated low-privilege user (RoleEditor or RoleReader) to invoke a DOM-transformation API that should be admin-only, and to trigger endpoint starvation by submitting large payloads that monopolize the per-path mutex. The CVSS 4.0 base score is 5.3 (Medium), reported by VulnCheck with a fix available in v3.7.4. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site request forgery in SiYuan's CheckAuth() session-cookie authentication branch affects all versions before 3.7.4, allowing remote attackers to perform unauthorized actions on behalf of authenticated users. The session-cookie code path neither validates Origin nor Referer headers, and omits an explicit SameSite attribute on session cookies, leaving browser-default SameSite policies as the sole defense - a gap exploitable via a crafted malicious page when the victim has an active authenticated session. The CVSS 4.0 score of 2.3 reflects genuinely constrained real-world risk; no public exploit has been identified and no active exploitation is confirmed.
Information disclosure and authentication bypass in SiYuan before v3.7.4 allows unauthenticated remote attackers to enumerate the existence and access tier of any document by exploiting observable behavioral differences in the `/api/filetree/authFilePublishAccess` endpoint. Beyond mere enumeration, the flaw carries a more severe secondary impact: because hidden and forbidden document tiers are stored with an empty password, submitting an empty-password request against those documents causes the server to issue a valid publish-auth cookie, granting the anonymous caller direct access to content the document owner explicitly restricted. No public exploit code has been identified at time of analysis.
The getAttributeViewBacklinks endpoint in SiYuan before v3.7.4 leaks hidden document metadata to unauthenticated network attackers due to a logic error that applies the wrong access control list during backlink filtering. By supplying a publicly visible database row identifier, anonymous users receive the database name, row title, and full document path of hidden-tier documents that reference that row - bypassing the visibility list entirely. No public exploit has been identified at time of analysis, but the zero-privilege, low-complexity network vector means any internet-exposed SiYuan instance is trivially interrogable.
SiYuan personal knowledge management software before v3.7.4 exposes block identifiers from restricted and password-protected documents via the unauthenticated `getRefIDsByFileAnnotationID` API endpoint, which processes annotation-to-block lookups without any publish-access authorization check. Remote unauthenticated attackers who can observe PDF annotation identifiers on published pages can query this endpoint to enumerate citation relationships spanning documents intended to be inaccessible, leaking structural metadata about restricted content. This CVE is absent from the CISA KEV catalog and no public exploit code has been identified at time of analysis, though the CVSS 4.0 AV:N/AC:L/PR:N/UI:N vector indicates the flaw is trivially reachable with no authentication prerequisite.
Missing authorization on SiYuan's /api/ref/refreshBacklink endpoint exposes instances prior to v3.7.4 to unauthenticated server-side write operations. Any network-accessible anonymous user can supply an attacker-controlled block ID to flush transaction queues, trigger global reference scans, and enqueue database writes, bypassing the application's read-only access controls. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the unauthenticated network vector and low attack complexity make this a viable target for resource amplification abuse.
The getLocalStorage API endpoint in SiYuan before v3.7.4 exposes the administrator's full local storage map to unauthenticated network callers and publish readers, with only three keys redacted by an incomplete sanitization filter. Sensitive operational metadata - including closed-tab history, search keywords, private document identifiers, and expanded folder paths - can be harvested in a single unauthenticated HTTP request against any network-accessible instance. No public exploit has been identified at time of analysis, but the zero-authentication, low-complexity attack path means any internet-exposed SiYuan deployment running a version below 3.7.4 is trivially reachable.
The getBookmarkLabels API endpoint in SiYuan before v3.7.4 exposes all workspace bookmark labels to unauthenticated and publish-mode readers due to missing authorization checks (CWE-862), leaking organizational metadata - topic taxonomy, project labels, and subject-matter vocabulary - from documents the requester cannot otherwise access. Any network-reachable SiYuan instance prior to v3.7.4 is affected regardless of publish-mode configuration, as the endpoint applies no access-control filtering. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; risk is primarily reconnaissance-enabling intelligence disclosure rather than direct data exfiltration.
Unauthorized document outline disclosure in SiYuan before v3.7.4 exposes heading identifiers for any document to unauthenticated network callers via the `/api/storage/getOutlineStorage` endpoint, which performs no authorization verification whatsoever. Affected are all SiYuan deployments (cpe:2.3:a:siyuan-note:siyuan:*) configured to listen on externally reachable interfaces running any version prior to v3.7.4. No public exploit has been identified at time of analysis, though the attack requires no credentials and is trivially automatable - any caller who supplies a document identifier retrieves its structural outline regardless of document-level access restrictions.
Unauthenticated access to the /api/block/getRefIDs endpoint in SiYuan before v3.7.4 exposes block reference metadata from password-protected documents, allowing remote attackers without any credentials to enumerate internal document structures. The endpoint fails to enforce the document-level password tier before returning block identifiers, meaning the password protection on sensitive documents is effectively bypassed for this API route. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in v3.7.4 per the GitHub Security Advisory GHSA-vg99-7gj7-2fr5.
Unauthenticated filesystem reconnaissance in SiYuan versions before v3.7.4 allows any network-reachable anonymous reader to probe arbitrary absolute paths on the host via the `getUniqueFilename` endpoint, which performs no authorization check or path confinement before returning existence results. The missing authorization control (CWE-862) means the attack requires zero credentials and zero user interaction against any exposed SiYuan HTTP interface, enabling structured enumeration of filesystem layout, installed software, and sensitive path locations as a precursor to more targeted attacks. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-barrier exploitation profile makes pre-attack reconnaissance trivially achievable against internet-exposed or LAN-accessible instances.
PDF annotation content in SiYuan through v3.7.2 is exposed without authorization via the /api/asset/getFileAnnotation endpoint, which applies only the generic CheckAuth middleware rather than the publish-access controls enforced on the /assets/* route. When publish authentication is disabled, anonymous readers can retrieve .sya annotation files containing private highlights and notes from password-protected, unpublished, or publish-forbidden documents simply by knowing a valid asset path; authenticated publish RoleReaders face the same missing check. The CVSS 4.0 score of 6.9 reflects a network-accessible, unauthenticated vector with limited scope - encrypted notebooks are not affected - and no public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in SiYuan's publish layer exposes password-protected attribute view data to unauthenticated remote users across all versions before v3.7.4. The FilterViewByPublishAccess filter omits its password enforcement on the renderAttributeView code path, allowing arbitrary callers to retrieve structured database rows - including document titles, block IDs, and column values - from documents the owner intended to gate with a publish password. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; vendor patch is available at v3.7.4.
Unauthorized information disclosure in SiYuan exposes protected document metadata and content snippets via three unenforced API endpoints - getBlockBreadcrumb, getRefText, and getBlockTreeInfos - in all versions before v3.7.4. Unauthenticated network actors or low-privilege RoleReader accounts can bypass publish-access controls on documents explicitly marked as publish-forbidden or password-protected, retrieving titles, ancestor block content snippets, reference text, and path metadata by supplying block IDs. No public exploit has been identified at time of analysis; vendor patch is available in v3.7.4.
Unauthenticated information disclosure in SiYuan versions before 3.7.4 allows retrieval of block attributes - names, aliases, memos, and custom fields - from documents protected by publish-access controls. The `getBlockAttrs` and `batchGetBlockAttrs` API endpoints accept POST requests with block IDs without verifying the caller's authorization against the parent document's access policy, directly bypassing the publish-access restriction (CWE-862). No active exploitation has been confirmed and no public proof-of-concept has been identified; impact is bounded to metadata exposure rather than full document content, but the unauthenticated network vector warrants prompt patching for internet-exposed instances.
Information disclosure in SiYuan before v3.7.4 allows unauthenticated remote attackers to retrieve the server's absolute filesystem workspace path, operating-system username, and installation layout by querying the resolveAssetPath endpoint with relative asset paths harvested from published documents. The endpoint enforces only a lightweight CheckAuth gate rather than full authentication, satisfying CWE-639's authorization bypass pattern, and returns raw absolute paths to any network-reachable caller. Vendor patch v3.7.4 has been released; no active exploitation has been confirmed and no public proof-of-concept code has been identified at time of analysis.
Missing authorization controls on three internal API endpoints in SiYuan before v3.7.4 allow callers operating within the publish context to retrieve database column schemas, template expressions, select vocabularies, and workspace-wide block identifiers that were never intended to cross publish access boundaries. The affected endpoints - getAttributeViewKeysByID, getBlockDefIDsByRefText, and getBlockRelevantIDs - perform their operations without consulting publish-scoped permission checks, constituting a CWE-862 (Missing Authorization) flaw. A vendor patch is available at v3.7.4, no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Five path-resolution API endpoints in SiYuan's publish mode fail to enforce access controls, allowing unauthenticated or minimally-authenticated readers to enumerate the complete private document tree. Affected versions are all SiYuan releases up to and including v3.7.2; v3.7.4 contains the fix. An attacker targeting a SiYuan instance running in publish mode with Publish.Auth.Enable set to false can call getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath without any credentials to recover notebook names, folder hierarchies, document titles, and document IDs - including for content explicitly marked hidden, password-protected, or publish-forbidden. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated information disclosure in SiYuan before v3.7.4 exposes encrypted notebook identifiers, names, and memory-resident unlock states via the getEncryptedNotebookStatus API endpoint without enforcing publish-access filtering. Any anonymous or publish-mode client that can reach the instance can enumerate the full list of encrypted notebooks and determine which are actively decrypted in server memory, leaking sensitive organizational metadata. No public exploit has been identified and no CISA KEV listing exists; a vendor-released patch is available in v3.7.4.
Static-route access control bypass in SiYuan before v3.7.4 allows attackers to read sensitive workspace data by directly accessing file-serving routes that skip the authorization checks enforced on the REST API. Affected deployments include any SiYuan instance operating in disabled-auth mode (anonymous access) or where publish reader tokens have been issued, as those token holders can reach templates, snippets, and export artifacts without restriction. No public exploit or active exploitation has been identified at time of analysis, but the patch to v3.7.4 is available and should be applied promptly given the unauthenticated attack vector in disabled-auth configurations.
SiYuan's /api/tag/getTag endpoint leaks tag labels and occurrence counts from password-protected documents to any unauthenticated network caller, constituting an authorization bypass under CWE-863. All SiYuan versions before 3.7.4 are affected, as confirmed by a vendor GitHub Security Advisory (GHSA-mp7r-57w4-5qm3) and the EUVD entry EUVD-2026-57452. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; however, the zero-friction network exploitability (PR:N, AC:L, UI:N) means any attacker with network reach can enumerate protected document vocabulary with a single API call.
Information disclosure in SiYuan v3.7.4-alpha.1 (pre-release only) permits any caller who passes basic authentication to retrieve complete database view metadata - including view names, icons, layout types, and per-field Hidden flags - for arbitrary database blocks by supplying an avID, regardless of their access level. The `/api/av/getAttributeViewFieldViews` endpoint introduced in commit acfc02ee8 applies `CheckAuth` middleware but omits any ownership or publish-access filter, producing a CWE-862 Missing Authorization condition. The vulnerability was corrected in the v3.7.4 stable release; no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated information disclosure in SiYuan before v3.7.4 exposes notebook metadata - including names, document counts, storage sizes, and timestamps - for closed and non-published notebooks via the /api/notebook/getNotebookInfo endpoint, which performs no authorization check. Any attacker with network access to the SiYuan API can enumerate structural information that the application's access control model explicitly intends to hide from readers. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-friction, unauthenticated attack path makes this trivially exploitable wherever the API is internet- or network-exposed.
Information disclosure in SiYuan before v3.7.4 exposes administrator workspace state to unauthenticated network attackers via an improperly protected getConf API endpoint. The UILayout filter fails to enforce authorization boundaries between publish readers and the administrative configuration layer, leaking open document names, recent search terms, notebook directory paths, and private asset locations. No public exploit code or CISA KEV listing exists at time of analysis; however, the unauthenticated network vector makes the flaw trivially reachable on any internet-exposed SiYuan instance with publish features active.
Metadata disclosure in SiYuan before v3.7.3 exposes document titles, notebook paths, root IDs, and icons for administrator-restricted documents via the unauthenticated `/api/block/getBlockInfo` endpoint. The publish-access control flag is never checked server-side before returning document root metadata, making this a complete bypass of SiYuan's per-document publish exclusion feature. No public exploit is identified at time of analysis and no KEV listing exists, but the CVSS 4.0 vector (PR:N, AC:L) confirms exploitation requires no credentials and no special conditions against the network-facing API.
Credential file exfiltration in SiYuan prior to 3.7.1 is possible through the POST /api/file/globalCopyFiles endpoint, which accepts arbitrary absolute source paths and relies on an incomplete denylist in util.IsSensitivePath to block sensitive files. The denylist omits common credential files including .git-credentials, .netrc, .pgpass, .kube/config, .docker/config.json, and .gnupg, enabling an authenticated administrator or API-token holder to copy these files into the workspace and read them via the file API. No public exploit code or CISA KEV listing exists at time of analysis, but the Docker tag suggests this is relevant in containerized deployments where host-mounted credential files may be accessible.
Missing authorization on the `/api/storage/getCriteria` endpoint in SiYuan personal knowledge management software exposes saved search criteria - including private document paths, notebook and block IDs, and search/replace keyword history - to any publish-mode Reader, bypassing the access controls applied by all sibling storage endpoints. All SiYuan releases prior to 3.7.1 are affected per the vendor security advisory GHSA-px3c-cf92-9g83. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the low attack complexity and readily available fix commit make this straightforward to weaponize against exposed instances.
SiYuan's personal knowledge management system prior to 3.7.0 exposes all user note content to unauthenticated database exfiltration through a deliberately auth-excluded API endpoint. The `/api/icon/getDynamicIcon` endpoint, when invoked with `type=8` and a valid block ID, renders a Go template that executes arbitrary SELECT queries against SiYuan's SQLite backend via `querySQL` and `queryBlocks` functions - functions designed for note querying but reachable without any credential check. An attacker with network adjacency who possesses a valid block ID can read the entire database: note content, tags, asset references, and block attributes. No public exploit or CISA KEV listing has been identified at time of analysis; the AC:H rating reflects the block ID prerequisite. A fix is available in version 3.7.0.
SiYuan 3.6.1 through 3.6.3 allows arbitrary code execution when users view malicious bazaar packages in the marketplace UI. The vulnerability stems from an incomplete XSS fix (for CVE-2026-33066) that enabled an HTML sanitizer but failed to block iframe tags with srcdoc attributes containing embedded scripts. A malicious package author can inject JavaScript that executes in the Electron process with full application privileges, compromising the user's machine. The issue is confirmed fixed in version 3.6.4 and no public exploitation has been reported at time of analysis.
SiYuan's SVG sanitizer fails to properly filter malicious href attributes when whitespace characters are inserted into javascript: URLs, allowing reflected cross-site scripting on the unauthenticated /api/icon/getDynamicIcon endpoint. Public exploit code exists for this vulnerability, which bypasses the previous fix for CVE-2026-29183. Attackers can inject executable JavaScript to target unauthenticated users of SiYuan versions prior to 3.5.10.
Reflected XSS in SiYuan's /api/icon/getDynamicIcon endpoint allows unauthenticated attackers to inject malicious JavaScript through SVG animation elements that bypass the sanitizer's static filters. The vulnerability exists because the SVG sanitizer blocks script tags and event handlers but fails to restrict <animate> and <set> elements, which can dynamically modify attributes at runtime to execute code. Public exploit code exists and patches are not yet available for affected versions prior to 3.5.10.
Stored XSS in Lute's Markdown rendering engine (versions 1.7.6 and earlier) allows authenticated attackers to inject malicious JavaScript into notes that executes when other users view the rendered content. SiYuan and other applications using vulnerable Lute versions are affected, with public exploit code available. A patch is available and should be applied to prevent session hijacking and credential theft.
SiYuan knowledge management system versions before 3.5.4 allow authenticated users to copy arbitrary files from the server filesystem into the application workspace due to insufficient path validation in the /api/file/globalCopyFiles endpoint. An attacker with valid credentials can exploit this path traversal vulnerability to read sensitive files and escalate privileges within the application. Public exploit code exists for this medium-severity vulnerability, though a patch is available.
Reflected XSS in SiYuan's /api/icon/getDynamicIcon endpoint allows attackers to inject malicious JavaScript through unescaped SVG content in dynamically generated icon images. An unauthenticated attacker can craft a malicious link that, when clicked by a victim, executes arbitrary scripts in the context of the SiYuan application. Public exploit code exists for versions prior to 3.5.4, which contains the necessary patches.
SiYuan prior to version 3.5.4-dev2 fails to sanitize SVG file uploads, allowing authenticated attackers to embed malicious JavaScript that executes when other users view the files. Public exploit code exists for this stored XSS vulnerability, which can compromise user sessions and access sensitive knowledge management data. The vulnerability affects self-hosted instances where users can upload SVG content from untrusted sources.
SiYuan is self-hosted, open source personal knowledge management software. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SiYuan is a personal knowledge management system. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
SiYuan is a personal knowledge management system. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
SiYuan is a personal knowledge management system. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
SiYuan is a personal knowledge management system. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in SiYuan 3.1.0 and classified as problematic. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SiYuan version 3.0.3 allows executing arbitrary commands on the server. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
High severity vulnerability in SiYuan Note. # The `/api/network/forwardProxy` endpoint allows authenticated users to make arbitrary HTTP requests from the server. The endpoint accepts a user-controlled URL and makes HTTP requests to it, returning the full response body and headers. There is no URL validation to prevent requests to internal networks, localhost, or cloud metadata services.
SiYuan prior to 3.5.10 has a path traversal vulnerability enabling arbitrary file access through crafted API requests.
SiYuan Note prior to version 3.5.10 contains an insufficient authorization flaw in the /api/block/appendHeadingChildren endpoint that allows authenticated users with read-only (RoleReader) privileges to modify notebook content by appending blocks to documents. The vulnerability exists because the endpoint applies only basic authentication checks instead of enforcing stricter administrative or read-only restrictions. Affected users should upgrade to version 3.5.10 or later, as no workaround is currently available and exploitation requires only network access and valid read-only credentials.
Reflected XSS in SiYuan knowledge management before 3.5.9.
SQL injection in SiYuan prior to version 3.6.0 allows any authenticated user, including those with read-only access, to execute arbitrary database queries through the /api/query/sql endpoint due to insufficient authorization checks. Public exploit code exists for this vulnerability, enabling attackers to extract sensitive data or modify the knowledge base contents. No patch is currently available for affected versions.
Unauthenticated attackers can read sensitive configuration files from SiYuan knowledge management systems prior to version 3.5.5 by exploiting case-sensitivity bypass in file access controls on Windows and other case-insensitive filesystems. The /api/file/getFile endpoint fails to properly validate mixed-case path traversal attempts, allowing unauthorized access to protected data. Public exploit code exists for this vulnerability, and no patch is currently available.
SiYuan knowledge management system prior to 3.5.5 has a path traversal in /api/file/copyFile allowing arbitrary file operations on the server.
SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code execution through crafted knowledge base entries.
Remote attackers can read arbitrary files from SiYuan servers (versions prior to 3.5.4) by exploiting server-side HTML rendering in the markdown feature. The path traversal vulnerability (CWE-22) requires no authentication and has low attack complexity, making it trivially exploitable. A public exploit exists and EPSS scoring indicates 9% exploitation probability (25th percentile), suggesting limited but active reconnaissance. Vendor patch available in version 3.5.4.
SiYuan versions through 3.8.4 fail to enforce authorization on the getDynamicIcon endpoint, allowing authenticated attackers holding a read-only publish token to disclose metadata-such as block titles, names, aliases, and hierarchical paths-of restricted documents via a template injection triggered by type=8 requests. The flaw is rated medium severity (vendor CVSS 5.3, independent CVSS 3.1 5.3) and impacts confidentiality only; no public exploit or active exploitation has been identified at time of analysis.
Information disclosure in Siyuan note-taking software before v3.8.2 allows unauthenticated publish-mode readers to probe the existence and quantity of private or unpublished content via the full-text search API. The POST /api/search/fullTextSearchBlock endpoint correctly withholds actual block content from hidden documents but leaks unfiltered match counts - the number of matching blocks and pages - enabling attackers to use the search API as an oracle to systematically map the structure of private content without ever seeing it. No public exploit code has been identified at time of analysis, and the vendor has released a patch in v3.8.2.
SiYuan's `getAttributeViewKeysByID` endpoint, present in all versions before v3.8.2, allows authenticated publish readers to retrieve full key schemas-including sensitive field names and relation definitions-from private or hidden databases they have no visibility into. The flaw is an authorization bypass (CWE-639/IDOR) where the endpoint validates that a caller holds a publish-reader session but never verifies the caller's access rights against the parent database owning the requested attribute view. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world risk moderate despite the network-accessible attack vector.
Authenticated readers in SiYuan v3.8.1 can call the POST /api/transactions/undoState endpoint with a known document root ID to retrieve internal root IDs of other documents - including private or unpublished ones - that participated in the same cross-document transaction. The flaw is CWE-639 (IDOR via user-controlled key): the endpoint reads from the global undo-log stack and returns peekMutatedRootIDs without applying publish-access visibility filtering to the returned identifiers. Document body contents are not exposed; however, internal identifiers and cross-document transaction relationships leak across trust boundaries. Vendor-released patch v3.8.2 resolves the issue; no public exploit or CISA KEV listing is known at time of analysis.
SiYuan's publish mode before v3.8.1 leaks invisible-tier content to unauthenticated readers through three unguarded rendering pathways: SQL embed blocks, attribute-view keys, and attribute-view backlinks. Administrators who mark notes as invisible to control what anonymous visitors see receive no protection - those same visitors can enumerate the hidden content by exploiting any of the three listing mechanisms. No active exploitation has been identified (no CISA KEV listing, no public POC), and the vendor has released a fix in v3.8.1.
Authenticated administrators in SiYuan before v3.8.1 can bypass the IsForbiddenAbsPath security guard - introduced to remediate GHSA-c8r8-95hg-mp34 - by targeting the /history/*path and /repo/diff/*path API endpoints, which construct file paths independently and were never covered by the guard. Exploitation enables retrieval of historical file snapshots including data/.siyuan/publishAccess.json, which stores plaintext publish-mode passwords, and files under data/templates/. No public exploit identified at time of analysis; the vendor-released patch is v3.8.1.
Path traversal in SiYuan 3.8.0 allows an authenticated attacker to read arbitrary files within the workspace directory via the POST /api/template/render endpoint, including conf/conf.json, which contains the API token and cookie signing key. The RenderTemplate function enforces only a workspace-boundary check (util.IsAbsPathInWorkspace) but omits the sensitive-path exclusion (refuseToAccess() blocklist) applied by the file API, creating an inconsistency in access controls across API surfaces. The issue is fixed in v3.8.1; no public exploit identified at time of analysis.
Path traversal in SiYuan's asset.upload MCP tool before v3.8.1 allows an attacker to exfiltrate arbitrary host files - including SSH keys and credentials - by supplying absolute paths that bypass workspace boundary validation. The attack is delivered via prompt injection against an AI Agent connected to SiYuan's MCP server, meaning exploitation depends on an AI agent processing attacker-controlled content. No public exploit or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact (CVSS 4.0: 6.9) reflects the potential to read any file the SiYuan process can access.
Plugin integrity bypass in SiYuan before v3.7.4 allows attackers with same-origin access to overwrite trusted, installed plugins by exploiting the bazaar install endpoint's failure to verify that the downloaded package content matches the caller-supplied packageName. By pairing a legitimate plugin's packageName with an attacker-controlled repoURL, an adversary substitutes malicious plugin code that persists across application restarts, achieving durable code execution within the SiYuan application context. No public exploit code or active exploitation has been identified at time of analysis, but the persistence mechanism elevates the practical impact beyond the moderate CVSS score.
Incomplete path blocklist in SiYuan's MCP file tool (versions before v3.8.0) allows authenticated administrators to read workspace files that the HTTP API is designed to protect, including plaintext publish-mode passwords from data/.siyuan/publishAccess.json. The flaw stems from a mismatch between the HTTP API's access restrictions and the MCP tool's narrower blocklist, classified as CWE-863 (Incorrect Authorization). No public exploit is identified at time of analysis; exploitation is bounded by the requirement for pre-existing administrator credentials.
Secret exfiltration via URL parameter interpolation in SiYuan's http_request MCP tool affects all versions before v3.8.0. An MCP client with elevated access can embed secret placeholder references directly in the destination URL of an http_request tool call, causing SiYuan to resolve and transmit stored plaintext secrets to any attacker-controlled host without user confirmation. No public exploit has been identified at time of analysis, but the exploitation mechanism is straightforward for any party holding MCP client access.
Full-read SSRF in SiYuan before v3.7.4 allows authenticated attackers to bypass the SafeMode SSRF guard by supplying URLs whose hostnames resolve to IPv6 transition addresses - NAT64 (64:ff9b::/96), 6to4 (2002::/16), or Teredo (2001::/32) - which encode private IPv4 destinations that the isPrivateIP function in kernel/util/net.go fails to classify as internal. Because the affected forward proxy, WebSocket proxy, and SSE proxy endpoints return the full response body, a successful bypass enables exfiltration of cloud instance metadata credentials (e.g., from 169.254.169.254), enumeration of internal services, and port-scanning of internal infrastructure. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVE description provides sufficient technical specificity to serve as an exploit development roadmap.
Insufficient access control on the /api/lute/spinBlockDOM endpoint in SiYuan before v3.7.4 allows any authenticated low-privilege user (RoleEditor or RoleReader) to invoke a DOM-transformation API that should be admin-only, and to trigger endpoint starvation by submitting large payloads that monopolize the per-path mutex. The CVSS 4.0 base score is 5.3 (Medium), reported by VulnCheck with a fix available in v3.7.4. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site request forgery in SiYuan's CheckAuth() session-cookie authentication branch affects all versions before 3.7.4, allowing remote attackers to perform unauthorized actions on behalf of authenticated users. The session-cookie code path neither validates Origin nor Referer headers, and omits an explicit SameSite attribute on session cookies, leaving browser-default SameSite policies as the sole defense - a gap exploitable via a crafted malicious page when the victim has an active authenticated session. The CVSS 4.0 score of 2.3 reflects genuinely constrained real-world risk; no public exploit has been identified and no active exploitation is confirmed.
Information disclosure and authentication bypass in SiYuan before v3.7.4 allows unauthenticated remote attackers to enumerate the existence and access tier of any document by exploiting observable behavioral differences in the `/api/filetree/authFilePublishAccess` endpoint. Beyond mere enumeration, the flaw carries a more severe secondary impact: because hidden and forbidden document tiers are stored with an empty password, submitting an empty-password request against those documents causes the server to issue a valid publish-auth cookie, granting the anonymous caller direct access to content the document owner explicitly restricted. No public exploit code has been identified at time of analysis.
The getAttributeViewBacklinks endpoint in SiYuan before v3.7.4 leaks hidden document metadata to unauthenticated network attackers due to a logic error that applies the wrong access control list during backlink filtering. By supplying a publicly visible database row identifier, anonymous users receive the database name, row title, and full document path of hidden-tier documents that reference that row - bypassing the visibility list entirely. No public exploit has been identified at time of analysis, but the zero-privilege, low-complexity network vector means any internet-exposed SiYuan instance is trivially interrogable.
SiYuan personal knowledge management software before v3.7.4 exposes block identifiers from restricted and password-protected documents via the unauthenticated `getRefIDsByFileAnnotationID` API endpoint, which processes annotation-to-block lookups without any publish-access authorization check. Remote unauthenticated attackers who can observe PDF annotation identifiers on published pages can query this endpoint to enumerate citation relationships spanning documents intended to be inaccessible, leaking structural metadata about restricted content. This CVE is absent from the CISA KEV catalog and no public exploit code has been identified at time of analysis, though the CVSS 4.0 AV:N/AC:L/PR:N/UI:N vector indicates the flaw is trivially reachable with no authentication prerequisite.
Missing authorization on SiYuan's /api/ref/refreshBacklink endpoint exposes instances prior to v3.7.4 to unauthenticated server-side write operations. Any network-accessible anonymous user can supply an attacker-controlled block ID to flush transaction queues, trigger global reference scans, and enqueue database writes, bypassing the application's read-only access controls. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the unauthenticated network vector and low attack complexity make this a viable target for resource amplification abuse.
The getLocalStorage API endpoint in SiYuan before v3.7.4 exposes the administrator's full local storage map to unauthenticated network callers and publish readers, with only three keys redacted by an incomplete sanitization filter. Sensitive operational metadata - including closed-tab history, search keywords, private document identifiers, and expanded folder paths - can be harvested in a single unauthenticated HTTP request against any network-accessible instance. No public exploit has been identified at time of analysis, but the zero-authentication, low-complexity attack path means any internet-exposed SiYuan deployment running a version below 3.7.4 is trivially reachable.
The getBookmarkLabels API endpoint in SiYuan before v3.7.4 exposes all workspace bookmark labels to unauthenticated and publish-mode readers due to missing authorization checks (CWE-862), leaking organizational metadata - topic taxonomy, project labels, and subject-matter vocabulary - from documents the requester cannot otherwise access. Any network-reachable SiYuan instance prior to v3.7.4 is affected regardless of publish-mode configuration, as the endpoint applies no access-control filtering. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; risk is primarily reconnaissance-enabling intelligence disclosure rather than direct data exfiltration.
Unauthorized document outline disclosure in SiYuan before v3.7.4 exposes heading identifiers for any document to unauthenticated network callers via the `/api/storage/getOutlineStorage` endpoint, which performs no authorization verification whatsoever. Affected are all SiYuan deployments (cpe:2.3:a:siyuan-note:siyuan:*) configured to listen on externally reachable interfaces running any version prior to v3.7.4. No public exploit has been identified at time of analysis, though the attack requires no credentials and is trivially automatable - any caller who supplies a document identifier retrieves its structural outline regardless of document-level access restrictions.
Unauthenticated access to the /api/block/getRefIDs endpoint in SiYuan before v3.7.4 exposes block reference metadata from password-protected documents, allowing remote attackers without any credentials to enumerate internal document structures. The endpoint fails to enforce the document-level password tier before returning block identifiers, meaning the password protection on sensitive documents is effectively bypassed for this API route. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in v3.7.4 per the GitHub Security Advisory GHSA-vg99-7gj7-2fr5.
Unauthenticated filesystem reconnaissance in SiYuan versions before v3.7.4 allows any network-reachable anonymous reader to probe arbitrary absolute paths on the host via the `getUniqueFilename` endpoint, which performs no authorization check or path confinement before returning existence results. The missing authorization control (CWE-862) means the attack requires zero credentials and zero user interaction against any exposed SiYuan HTTP interface, enabling structured enumeration of filesystem layout, installed software, and sensitive path locations as a precursor to more targeted attacks. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-barrier exploitation profile makes pre-attack reconnaissance trivially achievable against internet-exposed or LAN-accessible instances.
PDF annotation content in SiYuan through v3.7.2 is exposed without authorization via the /api/asset/getFileAnnotation endpoint, which applies only the generic CheckAuth middleware rather than the publish-access controls enforced on the /assets/* route. When publish authentication is disabled, anonymous readers can retrieve .sya annotation files containing private highlights and notes from password-protected, unpublished, or publish-forbidden documents simply by knowing a valid asset path; authenticated publish RoleReaders face the same missing check. The CVSS 4.0 score of 6.9 reflects a network-accessible, unauthenticated vector with limited scope - encrypted notebooks are not affected - and no public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in SiYuan's publish layer exposes password-protected attribute view data to unauthenticated remote users across all versions before v3.7.4. The FilterViewByPublishAccess filter omits its password enforcement on the renderAttributeView code path, allowing arbitrary callers to retrieve structured database rows - including document titles, block IDs, and column values - from documents the owner intended to gate with a publish password. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; vendor patch is available at v3.7.4.
Unauthorized information disclosure in SiYuan exposes protected document metadata and content snippets via three unenforced API endpoints - getBlockBreadcrumb, getRefText, and getBlockTreeInfos - in all versions before v3.7.4. Unauthenticated network actors or low-privilege RoleReader accounts can bypass publish-access controls on documents explicitly marked as publish-forbidden or password-protected, retrieving titles, ancestor block content snippets, reference text, and path metadata by supplying block IDs. No public exploit has been identified at time of analysis; vendor patch is available in v3.7.4.
Unauthenticated information disclosure in SiYuan versions before 3.7.4 allows retrieval of block attributes - names, aliases, memos, and custom fields - from documents protected by publish-access controls. The `getBlockAttrs` and `batchGetBlockAttrs` API endpoints accept POST requests with block IDs without verifying the caller's authorization against the parent document's access policy, directly bypassing the publish-access restriction (CWE-862). No active exploitation has been confirmed and no public proof-of-concept has been identified; impact is bounded to metadata exposure rather than full document content, but the unauthenticated network vector warrants prompt patching for internet-exposed instances.
Information disclosure in SiYuan before v3.7.4 allows unauthenticated remote attackers to retrieve the server's absolute filesystem workspace path, operating-system username, and installation layout by querying the resolveAssetPath endpoint with relative asset paths harvested from published documents. The endpoint enforces only a lightweight CheckAuth gate rather than full authentication, satisfying CWE-639's authorization bypass pattern, and returns raw absolute paths to any network-reachable caller. Vendor patch v3.7.4 has been released; no active exploitation has been confirmed and no public proof-of-concept code has been identified at time of analysis.
Missing authorization controls on three internal API endpoints in SiYuan before v3.7.4 allow callers operating within the publish context to retrieve database column schemas, template expressions, select vocabularies, and workspace-wide block identifiers that were never intended to cross publish access boundaries. The affected endpoints - getAttributeViewKeysByID, getBlockDefIDsByRefText, and getBlockRelevantIDs - perform their operations without consulting publish-scoped permission checks, constituting a CWE-862 (Missing Authorization) flaw. A vendor patch is available at v3.7.4, no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Five path-resolution API endpoints in SiYuan's publish mode fail to enforce access controls, allowing unauthenticated or minimally-authenticated readers to enumerate the complete private document tree. Affected versions are all SiYuan releases up to and including v3.7.2; v3.7.4 contains the fix. An attacker targeting a SiYuan instance running in publish mode with Publish.Auth.Enable set to false can call getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath without any credentials to recover notebook names, folder hierarchies, document titles, and document IDs - including for content explicitly marked hidden, password-protected, or publish-forbidden. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated information disclosure in SiYuan before v3.7.4 exposes encrypted notebook identifiers, names, and memory-resident unlock states via the getEncryptedNotebookStatus API endpoint without enforcing publish-access filtering. Any anonymous or publish-mode client that can reach the instance can enumerate the full list of encrypted notebooks and determine which are actively decrypted in server memory, leaking sensitive organizational metadata. No public exploit has been identified and no CISA KEV listing exists; a vendor-released patch is available in v3.7.4.
Static-route access control bypass in SiYuan before v3.7.4 allows attackers to read sensitive workspace data by directly accessing file-serving routes that skip the authorization checks enforced on the REST API. Affected deployments include any SiYuan instance operating in disabled-auth mode (anonymous access) or where publish reader tokens have been issued, as those token holders can reach templates, snippets, and export artifacts without restriction. No public exploit or active exploitation has been identified at time of analysis, but the patch to v3.7.4 is available and should be applied promptly given the unauthenticated attack vector in disabled-auth configurations.
SiYuan's /api/tag/getTag endpoint leaks tag labels and occurrence counts from password-protected documents to any unauthenticated network caller, constituting an authorization bypass under CWE-863. All SiYuan versions before 3.7.4 are affected, as confirmed by a vendor GitHub Security Advisory (GHSA-mp7r-57w4-5qm3) and the EUVD entry EUVD-2026-57452. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; however, the zero-friction network exploitability (PR:N, AC:L, UI:N) means any attacker with network reach can enumerate protected document vocabulary with a single API call.
Information disclosure in SiYuan v3.7.4-alpha.1 (pre-release only) permits any caller who passes basic authentication to retrieve complete database view metadata - including view names, icons, layout types, and per-field Hidden flags - for arbitrary database blocks by supplying an avID, regardless of their access level. The `/api/av/getAttributeViewFieldViews` endpoint introduced in commit acfc02ee8 applies `CheckAuth` middleware but omits any ownership or publish-access filter, producing a CWE-862 Missing Authorization condition. The vulnerability was corrected in the v3.7.4 stable release; no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated information disclosure in SiYuan before v3.7.4 exposes notebook metadata - including names, document counts, storage sizes, and timestamps - for closed and non-published notebooks via the /api/notebook/getNotebookInfo endpoint, which performs no authorization check. Any attacker with network access to the SiYuan API can enumerate structural information that the application's access control model explicitly intends to hide from readers. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-friction, unauthenticated attack path makes this trivially exploitable wherever the API is internet- or network-exposed.
Information disclosure in SiYuan before v3.7.4 exposes administrator workspace state to unauthenticated network attackers via an improperly protected getConf API endpoint. The UILayout filter fails to enforce authorization boundaries between publish readers and the administrative configuration layer, leaking open document names, recent search terms, notebook directory paths, and private asset locations. No public exploit code or CISA KEV listing exists at time of analysis; however, the unauthenticated network vector makes the flaw trivially reachable on any internet-exposed SiYuan instance with publish features active.
Metadata disclosure in SiYuan before v3.7.3 exposes document titles, notebook paths, root IDs, and icons for administrator-restricted documents via the unauthenticated `/api/block/getBlockInfo` endpoint. The publish-access control flag is never checked server-side before returning document root metadata, making this a complete bypass of SiYuan's per-document publish exclusion feature. No public exploit is identified at time of analysis and no KEV listing exists, but the CVSS 4.0 vector (PR:N, AC:L) confirms exploitation requires no credentials and no special conditions against the network-facing API.
Credential file exfiltration in SiYuan prior to 3.7.1 is possible through the POST /api/file/globalCopyFiles endpoint, which accepts arbitrary absolute source paths and relies on an incomplete denylist in util.IsSensitivePath to block sensitive files. The denylist omits common credential files including .git-credentials, .netrc, .pgpass, .kube/config, .docker/config.json, and .gnupg, enabling an authenticated administrator or API-token holder to copy these files into the workspace and read them via the file API. No public exploit code or CISA KEV listing exists at time of analysis, but the Docker tag suggests this is relevant in containerized deployments where host-mounted credential files may be accessible.
Missing authorization on the `/api/storage/getCriteria` endpoint in SiYuan personal knowledge management software exposes saved search criteria - including private document paths, notebook and block IDs, and search/replace keyword history - to any publish-mode Reader, bypassing the access controls applied by all sibling storage endpoints. All SiYuan releases prior to 3.7.1 are affected per the vendor security advisory GHSA-px3c-cf92-9g83. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the low attack complexity and readily available fix commit make this straightforward to weaponize against exposed instances.
SiYuan's personal knowledge management system prior to 3.7.0 exposes all user note content to unauthenticated database exfiltration through a deliberately auth-excluded API endpoint. The `/api/icon/getDynamicIcon` endpoint, when invoked with `type=8` and a valid block ID, renders a Go template that executes arbitrary SELECT queries against SiYuan's SQLite backend via `querySQL` and `queryBlocks` functions - functions designed for note querying but reachable without any credential check. An attacker with network adjacency who possesses a valid block ID can read the entire database: note content, tags, asset references, and block attributes. No public exploit or CISA KEV listing has been identified at time of analysis; the AC:H rating reflects the block ID prerequisite. A fix is available in version 3.7.0.
SiYuan 3.6.1 through 3.6.3 allows arbitrary code execution when users view malicious bazaar packages in the marketplace UI. The vulnerability stems from an incomplete XSS fix (for CVE-2026-33066) that enabled an HTML sanitizer but failed to block iframe tags with srcdoc attributes containing embedded scripts. A malicious package author can inject JavaScript that executes in the Electron process with full application privileges, compromising the user's machine. The issue is confirmed fixed in version 3.6.4 and no public exploitation has been reported at time of analysis.
SiYuan's SVG sanitizer fails to properly filter malicious href attributes when whitespace characters are inserted into javascript: URLs, allowing reflected cross-site scripting on the unauthenticated /api/icon/getDynamicIcon endpoint. Public exploit code exists for this vulnerability, which bypasses the previous fix for CVE-2026-29183. Attackers can inject executable JavaScript to target unauthenticated users of SiYuan versions prior to 3.5.10.
Reflected XSS in SiYuan's /api/icon/getDynamicIcon endpoint allows unauthenticated attackers to inject malicious JavaScript through SVG animation elements that bypass the sanitizer's static filters. The vulnerability exists because the SVG sanitizer blocks script tags and event handlers but fails to restrict <animate> and <set> elements, which can dynamically modify attributes at runtime to execute code. Public exploit code exists and patches are not yet available for affected versions prior to 3.5.10.
Stored XSS in Lute's Markdown rendering engine (versions 1.7.6 and earlier) allows authenticated attackers to inject malicious JavaScript into notes that executes when other users view the rendered content. SiYuan and other applications using vulnerable Lute versions are affected, with public exploit code available. A patch is available and should be applied to prevent session hijacking and credential theft.
SiYuan knowledge management system versions before 3.5.4 allow authenticated users to copy arbitrary files from the server filesystem into the application workspace due to insufficient path validation in the /api/file/globalCopyFiles endpoint. An attacker with valid credentials can exploit this path traversal vulnerability to read sensitive files and escalate privileges within the application. Public exploit code exists for this medium-severity vulnerability, though a patch is available.
Reflected XSS in SiYuan's /api/icon/getDynamicIcon endpoint allows attackers to inject malicious JavaScript through unescaped SVG content in dynamically generated icon images. An unauthenticated attacker can craft a malicious link that, when clicked by a victim, executes arbitrary scripts in the context of the SiYuan application. Public exploit code exists for versions prior to 3.5.4, which contains the necessary patches.
SiYuan prior to version 3.5.4-dev2 fails to sanitize SVG file uploads, allowing authenticated attackers to embed malicious JavaScript that executes when other users view the files. Public exploit code exists for this stored XSS vulnerability, which can compromise user sessions and access sensitive knowledge management data. The vulnerability affects self-hosted instances where users can upload SVG content from untrusted sources.
SiYuan is self-hosted, open source personal knowledge management software. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SiYuan is a personal knowledge management system. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
SiYuan is a personal knowledge management system. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
SiYuan is a personal knowledge management system. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
SiYuan is a personal knowledge management system. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in SiYuan 3.1.0 and classified as problematic. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SiYuan version 3.0.3 allows executing arbitrary commands on the server. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.