Skip to contentSiyuan-note Siyuan vulnerabilities
- b3log siyuanSiYuan has a Full-Read SSRF via /api/network/forwardProxyCVE-2026-32110Fix available8.3 High
- b3log siyuanSiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSSCVE-2026-31809Fix available6.4 Medium
- b3log siyuanSiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSSCVE-2026-31807Fix available6.4 Medium
- b3log siyuanSiYuan Note publish service authorization bypass allows low-privilege users to modify notebook contentCVE-2026-309267.1 High
- b3log siyuanSiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret LeakageCVE-2026-30869Fix available9.3 Critical
- b3log siyuanSiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript executionCVE-2026-29183Fix available9.3 Critical
- b3log siyuanSiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database accessCVE-2026-290735.7 Medium
- b3log siyuanLute has a Stored Cross-Site Scripting (XSS) via Markdown hyperlinkCVE-2026-256474.6 Medium
- b3log siyuanSiYuan has Arbitrary File Write via /api/file/copyFile leading to RCECVE-2026-255399.1 Critical
- b3log siyuanSiYuan has a File Read Interface Case Bypass VulnerabilityCVE-2026-259927.5 High
- b3log siyuanSiYuan vulnerable to Stored XSS / RCE via `setBlockAttrs` icon attributeCVE-2026-238525.8 Medium
- b3log siyuanSiYuan Vulnerable to Arbitrary File Read via File Copy FunctionalityCVE-2026-23851Fix available8.3 High
- b3log siyuanSiYuan vulnerable to arbitrary file readCVE-2026-23850Fix available7.8 High
- b3log siyuanSiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIconCVE-2026-23847Fix available2.1 Low
- b3log siyuanSiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File UploadCVE-2026-23645Fix available5.3 Medium
- b3log siyuanSiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session SecretCVE-2025-689486.9 Medium
- b3log siyuanSiYuan: ZipSlip -> Arbitrary File Overwrite -> RCECVE-2025-674887.8 High
- b3log siyuanSiYuan has an arbitrary file deletion vulnerabilityCVE-2025-21609Fix available8.7 High
- b3log siyuanSiYuan has an arbitrary file read via /api/template/renderCVE-2024-556578.7 High
- b3log siyuanSiYuan has an arbitrary file read and path traversal via /api/export/exportResourcesCVE-2024-556588.7 High
- b3log siyuanSiYuan has an arbitrary file write in the host via /api/asset/uploadCVE-2024-556598.7 High
- b3log siyuanSiYuan has an SSTI via /api/template/renderSprigCVE-2024-556606.9 Medium
- b3log siyuanSiYuan PDF PDF.js cross site scriptingCVE-2024-69385.3 Medium
- b3log siyuanSiYuan 3.0.3 - RCE via Server Side XSSCVE-2024-26929.0 Critical