Siyuan (B3log) - vulnerabilities (CVEs)

202 CVEs, 13 in the last 30 days, 880 known versions, newest CVE from 2026-10-28. Vendor: B3log.

CVEs of Siyuan

• CVE-2026-118680 - CVSS 5.9 (medium), 2026-10-28: SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke…
• CVE-2026-116171 - CVSS 5.9 (medium), 2026-10-25: SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives…
• CVE-2026-116170 - CVSS 6.9 (medium), 2026-10-25: SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query…
• CVE-2026-116169 - CVSS 5.4 (medium), 2026-10-25: SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing…
• CVE-2026-116168 - CVSS 6.9 (medium), 2026-10-25: SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path…
• CVE-2026-116167 - CVSS 7.6 (high), 2026-10-25: SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to…
• CVE-2026-116166 - CVSS 7.6 (high), 2026-10-25: SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain…
• CVE-2026-109310 - CVSS 7.1 (high), 2026-10-12: SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource…
• CVE-2026-109309 - CVSS 6.9 (medium), 2026-10-12: SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin…
• CVE-2026-105205 - CVSS 6.9 (medium), 2026-10-04: SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from…
• CVE-2026-104410 - CVSS 8.7 (high), 2026-10-02: SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows…
• CVE-2026-103763 - CVSS 6.9 (medium), 2026-10-02: SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded documents…
• CVE-2026-103762 - CVSS 6.9 (medium), 2026-10-02: SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that…
• CVE-2026-101092 - CVSS 6.9 (medium), 2026-09-28: SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths…
• CVE-2026-101091 - CVSS 7.1 (high), 2026-09-28: SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious…
• CVE-2026-100646 - CVSS 8.6 (high), 2026-09-26: SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in…
• CVE-2026-100645 - CVSS 8.6 (high), 2026-09-26: SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are…
• CVE-2026-100644 - CVSS 8.7 (high), 2026-09-26: SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without…
• CVE-2026-100643 - CVSS 8.5 (high), 2026-09-26: SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject…
• CVE-2026-100642 - CVSS 7.6 (high), 2026-09-26: SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants…
• CVE-2026-100641 - CVSS 8.6 (high), 2026-09-26: SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by…
• CVE-2026-100640 - CVSS 8.6 (high), 2026-09-26: SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats…
• CVE-2026-100639 - CVSS 8.8 (high), 2026-09-26: SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assigned via innerHTML…
• CVE-2026-100638 - CVSS 8.3 (high), 2026-09-26: SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create…
• CVE-2026-100637 - CVSS 8.3 (high), 2026-09-26: SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files…
• CVE-2026-100636 - CVSS 8.3 (high), 2026-09-26: SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrators to write…
• CVE-2026-100635 - CVSS 8.2 (high), 2026-09-26: SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite…
• CVE-2026-100634 - CVSS 5.3 (medium), 2026-09-26: SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process…
• CVE-2026-100633 - CVSS 8.5 (high), 2026-09-26: SiYuan is a self-hosted personal knowledge management system. In versions 3.8.0 through 3.8.3, the MCP file tool's sensitive-path guard…
• CVE-2026-93923 - CVSS 8.8 (high), 2026-09-18: SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers…
• CVE-2026-93922 - CVSS 8.8 (high), 2026-09-18: SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron…
• CVE-2026-93921 - CVSS 5.3 (medium), 2026-09-18: SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document…
• CVE-2026-93591 - CVSS 7.6 (high), 2026-09-18: SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string…
• CVE-2026-92986 - CVSS 8.8 (high), 2026-09-17: SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through…
• CVE-2026-92985 - CVSS 8.8 (high), 2026-09-17: SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious…
• CVE-2026-87815 - CVSS 8.7 (high), 2026-09-09: SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An…
• CVE-2026-87814 - CVSS 8.4 (high), 2026-09-09: SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed asset content…
• CVE-2026-87813 - CVSS 8.4 (high), 2026-09-09: SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML…
• CVE-2026-87812 - CVSS 7.4 (high), 2026-09-09: SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML…
• CVE-2026-87811 - CVSS 8.4 (high), 2026-09-09: SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes without proper attribute encoding. Attackers can craft…
• CVE-2026-87809 - CVSS 7.1 (high), 2026-09-09: Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown…
• CVE-2026-87810 - CVSS 6.9 (medium), 2026-09-09: Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters private blocks from…
• CVE-2026-87808 - CVSS 8.7 (high), 2026-09-09: SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2026-32767 (GHSA-j7wh-x834-p3r7). The prior fix (commit d5e2d0bc) added an administrator check for…
• CVE-2026-87807 - CVSS 8.7 (high), 2026-09-09: siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers…
• CVE-2026-86712 - CVSS 8.8 (high), 2026-09-08: SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the…
• CVE-2026-86192 - CVSS 7.1 (high), 2026-09-05: SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve…
• CVE-2026-86191 - CVSS 5.3 (medium), 2026-09-05: SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to…
• CVE-2026-85585 - CVSS 8.7 (high), 2026-09-04: SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every…
• CVE-2026-85584 - CVSS 8.7 (high), 2026-09-04: SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using…
• CVE-2026-85583 - CVSS 7.1 (high), 2026-09-04: SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized…
• CVE-2026-85581 - CVSS 8.7 (high), 2026-09-04: SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains…
• CVE-2026-85582 - CVSS 7.1 (high), 2026-09-04: SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated…
• CVE-2026-85580 - CVSS 7.1 (high), 2026-09-04: SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems.…
• CVE-2026-85578 - CVSS 7.1 (high), 2026-09-04: SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks…
• CVE-2026-85579 - CVSS 5.3 (medium), 2026-09-04: SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8.1, fixed in v3.8.2) in the reader-accessible POST /api/transactions/undoState…
• CVE-2026-85175 - CVSS 8.8 (high), 2026-09-03: SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks…
• CVE-2026-85174 - CVSS 8.8 (high), 2026-09-03: SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds.…
• CVE-2026-84803 - CVSS 9 (critical), 2026-09-02: SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable…
• CVE-2026-82654 - CVSS 9.3 (critical), 2026-08-30: SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a…
• CVE-2026-82653 - CVSS 9.3 (critical), 2026-08-30: SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated…
• CVE-2026-82652 - CVSS 6.9 (medium), 2026-08-30: SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode.…
• CVE-2026-82651 - CVSS 6.9 (medium), 2026-08-30: SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in…
• CVE-2026-82650 - CVSS 5.9 (medium), 2026-08-30: SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function (kernel/model/template.go), reachable via the…
• CVE-2026-82649 - CVSS 7 (high), 2026-08-30: SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an uncontrolled search path element vulnerability in its NSIS installer,…
• CVE-2026-82234 - CVSS 8.4 (high), 2026-08-28: SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform DNS resolution…
• CVE-2026-82233 - CVSS 6.9 (medium), 2026-08-28: SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace…
• CVE-2026-60084 - CVSS 8.7 (high), 2026-08-22: SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path…
• CVE-2026-62204 - CVSS 6.6 (medium), 2026-08-22: SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install endpoints. Attackers with same-origin…
• CVE-2026-60083 - CVSS 6.9 (medium), 2026-08-22: SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspace files protected…
• CVE-2026-59809 - CVSS 6.9 (medium), 2026-08-22: SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the http_request MCP tool, allowing attackers to exfiltrate stored…
• CVE-2026-77086 - CVSS 9.4 (critical), 2026-08-21: SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform…
• CVE-2026-75917 - CVSS 9.3 (critical), 2026-08-19: SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation (app/src/util/pathName.ts,…
• CVE-2026-75916 - CVSS 9.3 (critical), 2026-08-19: SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '((' block-reference autocomplete hint popup. In genHintItemHTML()…
• CVE-2026-74906 - CVSS 8.7 (high), 2026-08-18: SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility…
• CVE-2026-74905 - CVSS 7.1 (high), 2026-08-18: SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to…
• CVE-2026-74904 - CVSS 8.7 (high), 2026-08-18: SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and…
• CVE-2026-74903 - CVSS 5.3 (medium), 2026-08-18: SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth…
• CVE-2026-74902 - CVSS 9.3 (critical), 2026-08-18: SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them…
• CVE-2026-74868 - CVSS 8.7 (high), 2026-08-17: SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation…
• CVE-2026-74867 - CVSS 4.2 (medium), 2026-08-17: SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth() that lacks…
• CVE-2026-74802 - CVSS 8.2 (high), 2026-08-17: SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables…
• CVE-2026-74801 - CVSS 8.6 (high), 2026-08-17: SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process.…
• CVE-2026-74799 - CVSS 9.3 (critical), 2026-08-17: SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to…
• CVE-2026-74800 - CVSS 9.4 (critical), 2026-08-17: SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site…
• CVE-2026-74798 - CVSS 9.3 (critical), 2026-08-17: SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the database_clean MCP tool. The tool performs only an empty-string check on the id…
• CVE-2026-73056 - CVSS 9.8 (critical), 2026-08-16: SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The…
• CVE-2026-73054 - CVSS 8.7 (high), 2026-08-15: SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters…
• CVE-2026-73053 - CVSS 9.4 (critical), 2026-08-15: SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output.…
• CVE-2026-73052 - CVSS 9.4 (critical), 2026-08-15: SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort…
• CVE-2026-73050 - CVSS 9.4 (critical), 2026-08-15: SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight…
• CVE-2026-73047 - CVSS 8.6 (high), 2026-08-15: siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature…
• CVE-2026-73046 - CVSS 9.8 (critical), 2026-08-15: SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards…
• CVE-2026-73045 - CVSS 8.7 (high), 2026-08-15: SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows…
• CVE-2026-73044 - CVSS 9.4 (critical), 2026-08-15: SiYuan versions before v3.7.4 fail to validate or escape table column width values, allowing stored cross-site scripting injection into style attributes.…
• CVE-2026-73043 - CVSS 9.4 (critical), 2026-08-15: SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and…
• CVE-2026-73042 - CVSS 9.4 (critical), 2026-08-15: SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group,…
• CVE-2026-73041 - CVSS 9.4 (critical), 2026-08-15: SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious…
• CVE-2026-73630 - CVSS 6.9 (medium), 2026-08-14: SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth…
• CVE-2026-73049 - CVSS 6.9 (medium), 2026-08-14: SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access…
• CVE-2026-73048 - CVSS 6.9 (medium), 2026-08-14: SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers…