Cross-Site Scripting Vulnerability in SiYuan by SiYuan Note

CVE-2026-74902

What is CVE-2026-74902?

SiYuan versions prior to 3.7.4 are susceptible to a cross-site scripting vulnerability arising from inadequate validation of uploaded filenames. Attackers can exploit this flaw by uploading files with malicious names containing script payloads. These payloads can be executed with full operating system command access when users drag, drop, or paste these files into the editor. This vulnerability emphasizes the need for strict file upload validation practices to safeguard against potential exploits.

References