Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:siyuan:siyuan:*:*:*:*:*:*:*:*

4 briefs RSS
high advisory

Path Traversal in SiYuan Export Functionality

SiYuan versions prior to v3.8.4 are vulnerable to a path traversal attack via the exportBrowserHTML endpoint, allowing authenticated administrators to overwrite arbitrary index.html files.

SiYuan +3 web-vulnerability xss rce electron webserver sql-injection api-security
2r 5t 1c updated
high advisory

Remote Code Execution in SiYuan via Malicious Bookmark Labels

SiYuan versions prior to 3.8.4 contain a cross-site scripting vulnerability in bookmark label rendering that enables remote code execution due to insecure Electron configuration.

SiYuan +2 vulnerability rce electron xss web-application-vulnerability sql-injection data-exfiltration web-vulnerability +1
1r 5t 1c updated
critical advisory

SSRF Vulnerability in SiYuan via DNS Rebinding

SiYuan versions prior to 3.8.1 are vulnerable to server-side request forgery through a DNS rebinding attack, enabling unauthorized access to cloud metadata services and internal network resources.

SiYuan +5 ssrf vulnerability cloud-security web-vulnerability xss information-disclosure credential-access cve-2026-85174 +8
2r 6t 1c updated
critical advisory

Authentication Bypass in SiYuan Publish API

SiYuan versions prior to 3.7.4 contain an authentication bypass vulnerability allowing unauthenticated remote attackers to retrieve decrypted content from encrypted notebooks.

SiYuan +2 access-control web-vulnerability authentication-bypass information-disclosure api-security remote-code-execution vulnerability pdf-processing +9
7r 19t 5c updated