Information Disclosure in SiYuan by SiYuan Note

CVE-2026-101092

What is CVE-2026-101092?

The SiYuan application prior to version 3.8.4 exhibits a security vulnerability in the 'getCurrentAttrViewImages' API endpoint, which lacks proper access checks for published readers. This oversight enables malicious actors to exploit the endpoint by using database identifiers obtained through other parts of the application, thereby leaking sensitive image asset paths and filenames that would typically be restricted. This type of vulnerability could lead to unauthorized access to sensitive data, posing a significant risk to user confidentiality.

References