Security: siyuan-note/siyuan
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret LeakageGHSA-2h2p-mvfx-868w published
Mar 6, 2026 by 88250Critical -
Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript executionGHSA-6865-qjcf-286f published
Mar 4, 2026 by 88250Critical -
Stored Cross-Site Scripting (XSS) via Markdown hyperlinkGHSA-rw25-98wq-76qv published
Feb 5, 2026 by 88250Moderate -
Arbitrary File Write via /api/file/copyFile leading to RCEGHSA-c4jr-5q7w-f6r9 published
Jan 28, 2026 by 88250Critical -
File Read Interface Case Bypass VulnerabilityGHSA-f72r-2h5j-7639 published
Jan 28, 2026 by 88250High -
Direct SQL Query API accessible to Reader-level users enables unauthorized database accessGHSA-jqwg-75qf-vmf9 published
Mar 3, 2026 by 88250Moderate -
Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIconGHSA-w836-5gpm-7r93 published
Jan 18, 2026 by 88250Moderate -
Arbitrary File Read via File Copy FunctionalityGHSA-94c7-g2fj-7682 published
Jan 18, 2026 by 88250Critical -
Stored Cross-Site Scripting (XSS) via Unrestricted SVG File UploadGHSA-pcjq-j3mq-jv5j published
Jan 16, 2026 by 88250Moderate -
Information Disclosure and Authentication Bypass via Hardcoded Session SecretGHSA-f7ph-rc3w-qp28 published
Dec 26, 2025 by 88250Moderate