Server-Side Request Forgery Vulnerability in SiYuan by SiYuan Group

CVE-2026-74905

What is CVE-2026-74905?

SiYuan versions prior to v3.7.4 are impacted by a server-side request forgery (SSRF) vulnerability found in the isPrivateIP function of kernel/util/net.go. This flaw arises from the function's inadequate address checks, which fail to recognize certain IPv6 transition addresses such as NAT64, 6to4, and Teredo that encapsulate private IPv4 destinations. When the SafeMode is activated, an authenticated user can exploit this vulnerability through various proxy endpoints that connect to the network, enabling them to submit URLs that resolve to the vulnerable addresses. Consequently, this can result in unauthorized access to internal services and cloud metadata endpoints, thereby allowing attackers to steal sensitive instance credentials and conduct port scans on internal infrastructures.

References