The MCP file tool in SiYuan note-taking software has an incomplete blocklist for sensitive paths compared to the HTTP file API it claims to align with. This discrepancy allows an authenticated Administrator-level MCP client to read sensitive files such as data/.siyuan/publishAccess.json, exposing plaintext passwords that protect publish-mode shared notebooks and documents. Other sensitive paths blocked by the HTTP API remain accessible via the MCP tool. This issue persists despite prior remediation for a related vulnerability and represents a scope restriction failure in the MCP tool's path resolution logic.
An information disclosure vulnerability in SiYuan kernel allows any authenticated user to retrieve TLS private keys via the /api/file/getFile endpoint due to an incomplete blocklist in the IsForbiddenAbsPath() function. The TLS private key (conf/key.pem) and CA private key (conf/ca.key) are not blocked and can be accessed, potentially compromising encrypted communications and certificate trust. This affects all installations including those where TLS is inactive, as the key files are generated on every boot.
A vulnerability in the SiYuan kernel allows unauthorized access to historical snapshots of sensitive files such as data/.siyuan/publishAccess.json and data/templates/* via the /history/*path and /repo/diff/*path HTTP routes. These routes do not enforce the same access restrictions as live-file endpoints, potentially exposing plaintext publish-mode passwords and template files from prior versions. The issue arises because the new centralized guard util.IsForbiddenAbsPath() is not called in these handlers, leading to missing authorization checks on historical data.
SiYuan Agent Tools versions up to 3.8.0 contain a Server-Side Request Forgery (SSRF) vulnerability due to a DNS rebinding time-of-check to time-of-use (TOCTOU) flaw. The vulnerability arises because the SSRF protection performs a single DNS resolution at guard time but does not verify the IP address at connection time, allowing an attacker-controlled domain to bypass the check by returning a public IP initially and a private or loopback IP on connection. This enables access to internal services such as cloud instance metadata. The issue affects the AI Agent tools' http_request and web_fetch components and was patched in version 3.8.1.
SiYuan MCP's asset.upload tool allows reading arbitrary absolute file paths without workspace boundary checks, enabling an attacker who can influence the AI Agent to upload sensitive local files into the workspace. This vulnerability affects versions up to 3.8.0 and was patched in version 3.8.1. Exploitation requires user approval of a generic confirmation prompt, making the attack vector reliant on prompt injection and user interaction. The vulnerability leads to confidentiality breaches by exposing sensitive files such as SSH keys and cloud credentials via the workspace file API.
SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with full system access.
SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.
SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of restricted documents via template injection.
SiYuan's publish mode includes a 'protected' access level that requires a password to read documents. However, several content-returning API endpoints bypass this password check, allowing anonymous users to retrieve the full content of password-protected documents. This occurs because these endpoints do not enforce the password protection that the primary content endpoint applies. The vulnerability has been reproduced on live instances, demonstrating that an attacker can bypass the password gate and access protected content without authentication.
SiYuan before version 3.7.4 has a vulnerability in 17 block metadata and content endpoints within kernel/api/block.go. These endpoints lack proper authorization checks and publish-access filtering, allowing anonymous users to access private block content and metadata without authentication. This issue affects handlers such as getRefText, checkBlockExist, and getBlockBreadcrumb.
SiYuan versions before 3.7.4 have a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint. This endpoint disables origin validation by setting CheckOrigin to always return true, allowing attackers to establish WebSocket connections from malicious webpages. This enables authenticated network pivoting through the victim's machine by proxying arbitrary network traffic.
SiYuan versions before v3.7.4 have a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint. This flaw allows anonymous users to trigger persistent server-side writes and perform resource amplification attacks by invoking the endpoint with attacker-controlled input. The advisory is a duplicate and has been withdrawn in favor of GHSA-wgwx-479j-23vq. No patch information is provided in this record.
SiYuan versions up to and including v3.7.2 have a critical SQL injection vulnerability in the backlink/mention search functionality. The vulnerability arises because stored block metadata and client-supplied keywords are concatenated into a SQL MATCH/search statement with insufficient escaping, allowing single quotes to break out of string literals. This enables an attacker to execute arbitrary SQL commands on the main read-write database handle, potentially reading and writing across notebooks. The issue is fixed in version v3.7.4.
SiYuan versions before v3.7.4 have a critical vulnerability in the WebSocket broadcast feature that allows anonymous users to bypass publish boundaries and receive live, unfiltered content updates. This includes edits to password-protected and forbidden documents without any authentication. The advisory is a duplicate and refers to GHSA-mw8r-mw84-88v2 for the original report.
SiYuan versions before v3.7.4 have an information disclosure vulnerability in the /api/block/getRefIDs endpoint. This endpoint does not properly enforce password protection tiers, allowing unauthenticated users to discover references to specific blocks within password-protected documents without needing the document password. The advisory is a duplicate and has been withdrawn in favor of GHSA-vg99-7gj7-2fr5.
A missing authorization vulnerability exists in SiYuan's development branch in the /api/av/getAttributeViewSearchTarget endpoint. This endpoint allows anonymous users to retrieve database row content without proper publish-access checks. The issue was introduced in a commit not present in stable versions and was patched in version 3.7.4. No stable released version is affected.
SiYuan versions up to and including v3.7.2 contain an authentication bypass vulnerability in the kernel's CheckAuth function. This flaw grants administrator privileges to any request originating from the loopback address (127.0.0.1) for certain endpoints, bypassing access auth codes. The vulnerability can potentially be exploited remotely via a fixed-port reverse proxy that forwards requests over loopback without proper authentication token injection or trusted proxy configuration. The issue was patched in version v3.7.4. This advisory is a duplicate and has been withdrawn in favor of GHSA-3mp7-4rh5-jrv9.
SiYuan versions up to and including v3.7.2 have an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint. This endpoint returns PDF annotation content without enforcing publish-access checks, allowing unauthorized access to private annotations of forbidden, password-protected, or unpublished documents. The vulnerability does not expose annotations in encrypted notebooks. It was fixed in version v3.7.4.
SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns. This flaw allows execution of arbitrary SQL commands on the victim's kernel when a malicious package with crafted template columns is imported and rendered. The vulnerability arises because the queryBlocks function executes raw SQL using string substitution instead of parameterized queries. This enables attackers to gain read and write access across notebooks.
SiYuan versions before v3.7.4 have an authentication bypass vulnerability in the FilterViewByPublishAccess filter. This flaw allows unauthenticated users to access password-protected document rows, including sensitive metadata like titles and block IDs, without providing the required password. The advisory is marked as a duplicate of GHSA-6mcf-g667-w3qv and has been withdrawn to preserve external references.