Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Release: siyuan-note siyuan 3.7.4 Clear all filters
TI-2026-51714 CVE-2026-73630 · GHSA-4pjg-x8qj-33j5 · GHSA-vg9q-fc8f-43f3

SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess

Priority LOW 36

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00343 Published 2026-08-14 Fixed in 3.7.4, 0.0.0-20260731093152-c7522b8db586 CWE-203
TI-2026-51258 CVE-2026-73049 · GHSA-6xvp-3rfv-g2g2 · GHSA-p4qw-vx5p-g984

SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks

Priority HIGH 70

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00325 Published 2026-08-14 Fixed in 3.7.4, 0.0.0-20260730150429-5b42614311b0 CWE-863
TI-2026-51257 CVE-2026-73048 · GHSA-p6g3-j3g7-h96w

SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID

Priority HIGH 70

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00325 Published 2026-08-14 Fixed in 3.7.4 CWE-862
TI-2026-51038 CVE-2026-72812 · GHSA-wgwx-479j-23vq

SiYuan before v3.7.4 Missing Authorization via refreshBacklink

Priority LOW 37

SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00377 Published 2026-08-14 Fixed in 3.7.4, 0.0.0-20260723002528-7d273c271ce1 CWE-862
TI-2026-51037 CVE-2026-72811 · GHSA-q2vg-7qgx-x5fc

SiYuan before v3.7.4 SQL Injection via backlink search

Priority MEDIUM 49

SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored block metadata (title, name, alias, anchor text) and the client-s…

CVSS 4.0CRITICAL 9.9 Network No auth No interaction EPSS 0.00436 Published 2026-08-14 Fixed in 3.7.4, 0.0.0-20260723004839-1a5b3431d5ab CWE-89
TI-2026-51036 CVE-2026-72810 · GHSA-mw8r-mw84-88v2

SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket

Priority HIGH 79

SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00538 Published 2026-08-14 Fixed in 3.7.4, 0.0.0-20260723013612-ba948639d7f6 CWE-862