Information Disclosure Vulnerability in SiYuan by SiYuan Note

CVE-2026-126264

What is CVE-2026-126264?

SiYuan versions prior to 3.8.9 expose an information disclosure vulnerability that allows authenticated Reader users to bypass security measures and access sensitive credential-specific widget files. This flaw can lead to unauthorized retrieval of API keys, tokens, and other confidential information stored within these files. Attackers can exploit this vulnerability by requesting specific file paths, compromising the security of the application and potentially leading to further exploitation.

References