Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: siyuan-note siyuan 3.7.2 Clear all filters
TI-2026-46770 CVE-2026-65607 · GHSA-2vq9-c755-fq2h

SiYuan before v3.7.2 Path Traversal via /export/temp/

Priority LOW 32

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go).

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00586 Published 2026-07-23 Fixed in 3.7.2 CWE-22
TI-2026-46769 CVE-2026-65606 · GHSA-3vr3-hq5c-q2w9

SiYuan before v3.7.2 Cross-Site Scripting to RCE

Priority HIGH 76

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler.

CVSS 4.0CRITICAL 9.4 Network No auth User interaction EPSS 0.0079 Published 2026-07-23 Fixed in 3.7.2 CWE-79
TI-2026-46768 CVE-2026-65605 · GHSA-99f6-8pmj-83xw

SiYuan before v3.7.2 Stored XSS to RCE via Attribute View

Priority HIGH 76

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering.

CVSS 4.0CRITICAL 9.4 Network No auth User interaction EPSS 0.0079 Published 2026-07-23 Fixed in 3.7.2 CWE-79