siyuan-note versions prior to 3.8.2 have an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint via the method=1 query parameter. This flaw allows attackers to inject UNION SELECT statements to read the entire blocks table, bypassing publish-access controls and exposing all document content and sensitive attributes. The vulnerability has a high severity with a CVSS score of 8.7.
SiYuan versions prior to 3.7.4 have a path traversal vulnerability in the /api/search/removeTemplate endpoint. This flaw allows authenticated admin users to supply arbitrary filesystem paths to a deletion function, enabling recursive deletion of files or directories with the kernel process's permissions. The vulnerability is rated high severity with a CVSS 4.0 score of 8.4.
SiYuan note-taking software versions before 3.8.0 have an authorization flaw in the MCP file tool. This flaw results from an incomplete path blocklist that does not properly restrict access to sensitive workspace files via the HTTP API. Authenticated administrators can exploit this to read plaintext publish-mode passwords and access other sensitive configuration files.
SiYuan note-taking software versions prior to 3.8.0 contain a vulnerability where secret placeholders are interpolated into the destination URL parameter of the http_request MCP tool. This allows an attacker controlling an MCP client to craft requests that exfiltrate plaintext secret values to arbitrary external hosts without user confirmation.
SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operations or recursively delete directories via uninstall operations by supplying crafted packageName values.
SiYuan versions before 3.7.4 contain a critical cross-site scripting (XSS) vulnerability in the file-tree picker's hover-tooltip generation. This flaw arises from improper escaping of document metadata fields concatenated into an aria-label attribute, allowing injection of arbitrary HTML attributes and inline event handlers. Due to the Electron BrowserWindow configuration (nodeIntegration:true, contextIsolation:false, no CSP), this XSS can escalate to arbitrary OS command execution when a user hovers over a malicious document entry. The vulnerability affects local installations and can be triggered via shared, synced, or imported malicious documents.
SiYuan note-taking application versions up to 3.7.3 contain a critical cross-site scripting (XSS) vulnerability in the block-reference autocomplete hint popup. The vulnerability arises because user-controllable metadata fields are concatenated into HTML without proper escaping, allowing injection of malicious scripts. Due to SiYuan's Electron environment configuration (nodeIntegration enabled, contextIsolation disabled, no CSP), this XSS can escalate to arbitrary OS command execution.
SiYuan note-taking software versions before 3.7.4 have an incorrect authorization vulnerability affecting eight publish-mode reader-facing endpoints. These endpoints incorrectly filter content using a visibility list instead of a disabled list, allowing anonymous users to access documents explicitly marked as forbidden from publishing. This vulnerability enables unauthorized discovery and reading of restricted content via search, backlink, asset content, saved criteria, recent documents, graph, and tag endpoints.
SiYuan note-taking software versions before 3.7.4 contain a server-side request forgery (SSRF) vulnerability in the isPrivateIP function. This function fails to recognize certain IPv6 transition addresses that embed private IPv4 destinations, allowing authenticated attackers to bypass SSRF protections in SafeMode. Exploitation can occur via network forward proxy, WebSocket proxy, or SSE proxy endpoints, enabling attackers to access internal services and cloud metadata endpoints such as 169.254.169.254. The vulnerability allows full-read SSRF, potentially leading to credential theft and internal network reconnaissance.
CVE-2026-74802 is a high-severity vulnerability in the siyuan-note software (version 3.7.3 and earlier) involving an origin validation bypass in an admin-only WebSocket proxy endpoint. The endpoint disables origin checks by overriding the gorilla/websocket library's default origin validation, allowing cross-site WebSocket hijacking. This enables an attacker to leverage a victim's active admin session to proxy arbitrary network traffic through the victim's machine, potentially accessing internal or localhost-only services. No patch is currently available for this issue.
CVE-2026-74800 is a critical stored cross-site scripting (XSS) vulnerability in SiYuan note-taking software versions prior to 3.7.4. The issue arises because the software fails to set the Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets. Authenticated attackers can exploit this by uploading malicious HTML files as assets, which execute scripts with full kernel API access when the workspace owner opens the asset link.
SiYuan Note versions prior to 3.7.4 have a vulnerability in the CheckAuth() middleware that allows unlimited automated guesses of the API token via the Authorization header or token query parameter. This bypasses CAPTCHA and lockout protections, enabling unauthenticated attackers to gain full administrator access. The vulnerability is critical with a CVSS score of 9.3.
SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated query parameters to bypass access auth code validation and receive the live kernel event stream including document identifiers, titles, and operation logs.
SiYuan before v3.7.4 stores attribute-view field names without HTML escaping and interpolates them directly into option elements via innerHTML in the sort menu. Attackers can inject markup by renaming a database field to execute arbitrary JavaScript when users open the sort menu, with Node integration enabled in the desktop client enabling code execution.
siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduced in v3.7.0-beta.1). The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and getHostByName functions that were removed elsewhere for CVE-2024-55660. A local, unauthenticated attacker (the kernel binds to 127.0.0.1 by default with no per-UID access control) can inject a malicious Template calculation formula to read environment variables belonging to the account running siyuan — including from a separate, unprivileged OS account — and to perform DNS lookups from the server's network position.
SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the CAPTCHA/lockout gate or increments the failure counter used by the cookie/session login path. This allows unauthenticated remote attackers to brute-force the admin access code with unlimited automated requests and obtain full RoleAdministrator access to the kernel. A secondary weakness exists because the access code is compared using a non-constant-time string comparison.
**CVE:** This vulnerability corresponds to [CVE-2026-72811](https://nvd.nist.gov/vuln/detail/CVE-2026-72811).
### Summary
The backlink/mention search query (`kernel/model/backlink.go`) concatenates stored block metadata (title, name, alias, anchor text) and the client-supplied keyword into a SQL `MATCH`/search statement, escaping only the double-quote character (`"`) and not the single quote (`'`). A single quote in either the client keyword or in stored document metadata breaks out of the string literal. The query runs on the main read-write `siyuan.db` handle through a statement-stacking-capable driver.
This yields two vectors:
- **First-order:** a client-supplied keyword containing `'` injects directly. This path is reachable by an anonymous reader on the publish surface.
- **Second-order:** a document whose title/name/alias contains `'` is stored safely (indexing uses parameterized inserts) but detonates when that stored value is later concatenated into the backlink query including on another user's kernel that has ingested the malicious document.
### Details
**Storage is safe; reuse is not.** Indexing INSERTs (`kernel/sql/upsert.go`) are parameterized (`(?,?,…)` with bound arguments for `Name`/`Content`/`Markdown`/`IAL`), so malicious `.sy` content is stored intact and safely. The injection is in the *reuse* path: the backlink/mention MATCH query (`kernel/model/backlink.go`, around line 980) builds its condition by concatenating the stored title/name/alias/anchor and the client keyword, applying only `"`→escaping and not `'`. A `'` in either source terminates the literal and lands in SQL context.
**Sink / handle.** The concatenated statement reaches `SelectBlocksRawStmtNoParse` → `query()` on the global read-write `siyuan.db` handle (DSN has no `mode=ro`/`_query_only`), driven by the vendored `88250/go-sqlite3` fork whose connection `query` loops over `;`-separated statements (stacking possible). Ceiling is arbitrary SQL cross-notebook read and write.
**Route / auth tier.** The backlink/mention family (`getBacklink`, `getBacklink2`, `getBacklinkDoc`, `getBackmentionDoc`) is `CheckAuth`-only, so the first-order client-keyword vector is reachable by the publish `RoleReader` token and by the anonymous account when `Publish.Auth.Enable` is `false`.
**Scope of the injection surface (confirmed the only second-order sink).** A sweep of the query paths that reuse stored content confirmed this is the sole injectable reuse sink: indexing INSERTs are parameterized, tag search uses `content LIKE ?` with pattern escaping, virtual refs use in-memory matching (no SQL), `IN(...)` joins use node-IDs/hex-hashes/ROWIDs (no quote surface), and the graph name/content filter escapes `'`. Only the backlink/mention MATCH path concatenates with `'` unescaped.
### Proof of Concept
Reproduced on a local instance (SiYuan running locally, publish mode enabled on port 6808, publish Basic Auth disabled). Strictly non-destructive verification, a syntax-error probe and a stored-value observation; no UNION exfiltration, no write, no DDL.
**First-order (client keyword), anonymous reader on port 6808:**
```
POST http://127.0.0.1:6808/api/ref/getBacklink2
{"id":"<block id>","k":"a'b","mk":""}
```
The keyword `a'b` reaches the concatenated `MATCH` condition and produces a SQL parse error, confirming the single quote breaks out of the literal and the client keyword lands in SQL context.
**Second-order (stored title), setup via admin then observed anonymously:**
A document whose title contains a single quote e.g. `("locked-doc")` style metadata is stored safely by the parameterized indexer, then appears at the exact unescaped position in the backlink query when that document participates in a backlink/mention lookup, breaking the query the same way. This demonstrates that stored document metadata detonates on reuse, independent of the client keyword.
Verification was limited to the syntax-error probe and the stored-value position observation; no exfiltration or write statement was executed. Full reproduction detail available privately on request.
### Impact
**First-order:** an anonymous reader (publish mode with auth disabled) or any publish `RoleReader` injects arbitrary SQL into the backlink/mention query via the keyword parameter, on the read-write main handle: cross-notebook read disclosure and, via statement stacking, write and `ATTACH`. This is the same anonymous-arbitrary-SQL severity as the search/embed injection findings, on a different sink.
**Second-order:** a document whose title/name/alias contains injection content is stored safely but executes when that stored value is concatenated into the backlink query. This fires on any kernel that has ingested the malicious document for example via a shared or imported `.sy` file, sync, or an opened `.sy.zip`. The precondition here is content delivery into the victim workspace (not a direct anonymous request), so it is a distinct, delivery-dependent threat model from the f
SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document identifiers, and expanded folder paths by calling the getLocalStorage endpoint.
SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement. Attackers can supply arbitrary absolute paths to determine whether files and directories exist on the host, enabling reconnaissance of the filesystem layout and installed software.
**CVE:** This vulnerability corresponds to [CVE-2026-72808](https://nvd.nist.gov/vuln/detail/CVE-2026-72808).
### Summary
The `/api/asset/getFileAnnotation` endpoint returns the content of `.sya` PDF-annotation files with no publish-access check. It is gated by `CheckAuth` only, so it is reachable by the publish `RoleReader` token and by the anonymous account when `Publish.Auth.Enable` is `false`. Its sibling, the `/assets/*` asset route does enforce publish access, including the publish password. An anonymous reader who knows an asset path can therefore read the private PDF annotations (highlights, notes) attached to assets in publish-forbidden, password-protected, or unpublished documents.
### Details
`getFileAnnotation` resolves the annotation file via `GetAssetAbsPathInBox` (no path traversal) and returns the `.sya` content. Unlike the `/assets/*` route, which applies the publish-access filter including password enforcement before serving asset bytes, `getFileAnnotation` applies no publish-access, publish-ignore, or password check. The guarded-sibling asymmetry indicates the boundary is meant to apply to this data and was omitted here.
`.sya` files for encrypted-box assets are fail-closed and not exposed. The gap is limited to non-encrypted assets.
**Route / auth tier.** `getFileAnnotation` is registered `CheckAuth`-only. `CheckAuth` admits `RoleReader`; the publish proxy forwards port-6808 traffic with a Reader JWT (anonymous when publish auth is disabled).
### Proof of Concept
Reproduced on a local instance (publish mode on 6808, Basic Auth off).
**Setup (admin, 6806):**
1. `createNotebook{name:"AnnotPoc"}` → box
2. `createDocWithMd{notebook, path:"/annot-victim", markdown:"doc with a pdf"}` → doc
3. `POST /api/asset/upload` (multipart `id=<doc>`, `file[]=@secret.pdf`) → `assets/secret-...pdf`
4. `setFileAnnotation{path:"<asset>.sya", data:"{annotSecret:ANNOT_SECRET_4471,note:private highlight}"}`
5. `setPublishAccess{id:<doc>, visible:false, password:"", disable:true}` → doc forbidden
**Exploit (anonymous reader, 6808, no token):**
```
POST http://127.0.0.1:6808/api/asset/getFileAnnotation
{"path":"assets/secret-...pdf.sya"}
```
Returns:
```
{"code":0,"data":{"data":"{\"annotSecret\":\"ANNOT_SECRET_4471\",\"note\":\"private highlight\"}"}}
```
The annotation content of a publish-forbidden document is returned to an anonymous reader with no publish-access check, while the `/assets/*` route serving the same asset class enforces publish access and password.
### Impact
An anonymous reader (publish mode with auth disabled) or any publish `RoleReader` can read the private PDF annotations (highlights and notes) of assets belonging to publish-forbidden, password-protected, or unpublished documents, given the asset path. This defeats the publish-access/password boundary for annotation data. Scope is limited to annotated PDFs in non-encrypted notebooks; encrypted-box annotations are not exposed. Confidentiality-only.
### Suggested fix
Apply the same publish-access check the `/assets/*` route uses to `getFileAnnotation` resolve the asset's owning document and enforce the publish-access/publish-ignore / password check before returning `.sya` content.