Threat database

CVE-2026-23851 is a high-severity path traversal vulnerability in SiYuan Note versions prior to 3.5.4. It affects the /api/file/globalCopyFiles endpoint, allowing authenticated users to copy arbitrary files from anywhere on the server into the application's workspace due to insufficient path validation. The vulnerability arises because the code verifies file existence but does not restrict source paths to authorized directories. Exploitation requires authentication but no user interaction and can lead to unauthorized file access and potential data leakage or manipulation. The issue is patched in version 3.5.4. European organizations using affected SiYuan versions should prioritize upgrading to mitigate risks.

EPSS 0.5%Vulnerabilitysiyuan-note#cwe-22Germany+7

CVE-2026-23850 is a high-severity path traversal vulnerability in SiYuan Note versions prior to 3.5.4. It arises from improper limitation of pathnames in the markdown feature, which allows unrestricted server-side HTML rendering. This flaw enables an unauthenticated attacker to perform arbitrary local file read (LFD) on the affected system without user interaction. The vulnerability has a CVSS 4.0 base score of 7.8, indicating significant risk due to its network exploitability and lack of required privileges. Although no known exploits are currently reported in the wild, the impact on confidentiality is high, as sensitive files could be exposed. European organizations using SiYuan Note for personal knowledge management should prioritize upgrading to version 3.

EPSS 0.6%Vulnerabilitysiyuan-note#cwe-22Germany+7

CVE-2026-23847 is a reflected cross-site scripting (XSS) vulnerability in SiYuan, a personal knowledge management system, affecting versions prior to 3.5.4. The flaw exists in the /api/icon/getDynamicIcon endpoint, which generates SVG images for text icons by inserting user-supplied content directly into an SVG <text> tag without proper XML escaping. Because the response is served with the image/svg+xml content type, attackers can inject malicious JavaScript by breaking the XML structure, leading to script execution in the victim's browser. The vulnerability requires no authentication but does require user interaction to trigger the malicious payload. The CVSS 4.0 score is low (2.1), reflecting limited impact and ease of exploitation. The issue was patched in version 3.

EPSS 0.3%Vulnerabilitysiyuan-note#cwe-79Germany+4

CVE-2026-23645 is a stored Cross-Site Scripting (XSS) vulnerability in SiYuan Note versions prior to 3.5.4-dev2. The flaw arises because the application fails to sanitize uploaded SVG files, allowing malicious JavaScript embedded in SVGs to execute in the context of an authenticated user's session. Exploitation requires a user to upload and then view a crafted SVG file, leading to arbitrary script execution without requiring authentication or elevated privileges. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. There are no known exploits in the wild as of now. European organizations using SiYuan Note for personal knowledge management should upgrade to version 3.

EPSS 0.3%Vulnerabilitysiyuan-note#cwe-79Germany+7

SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded cryptographic secret for its session store. This unsafe practice renders the session encryption ineffective. Since the sensitive AccessAuthCode is stored within the session cookie, an attacker who intercepts or obtains a user's encrypted session cookie (e.g., via session hijacking) can locally decrypt it using the public key. Once decrypted, the attacker can retrieve the AccessAuthCode in plain text and use it to authenticate or take over the session.

EPSS 0.2%Vulnerabilitysiyuan-note#cwe-321Germany+7

SiYuan is self-hosted, open source personal knowledge management software. Versions 0.0.0-20251202123337-6ef83b42c7ce and below contain function importZipMd which is vulnerable to ZipSlips, allowing an authenticated user to overwrite files on the system. An authenticated user with access to the import functionality in notes is able to overwrite any file on the system, and can escalate to full code execution under some circumstances. A fix is planned for version 3.5.0.

EPSS 0.4%Vulnerabilitysiyuan-note#cwe-22Germany+7