All vulnerabilities
CVE-2026-101092GHSA-j9p6-5639-gf4f

SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages

siyuan-note siyuan
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 1 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.8.4Fixed versionCVE List
Published28 Sep 2026Updated 1 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to leak detached-row image asset paths and filenames that the rendering endpoint would deny.

Text from CVE List

Affected versions 2

  • siyuanaffected: all versions before 3.8.4CVE List
  • siyuanunaffected: 3.8.4CVE List

References 3