Security: siyuan-note/siyuan
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
getRefIDsByFileAnnotationID returns the identifiers of blocks citing a PDF annotation with no publish-access filtering, including blocks the same session is told do not existGHSA-f3q6-vc7q-m6h7 published
Jul 31, 2026 by 88250Moderate -
The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readersGHSA-p4qw-vx5p-g984 published
Jul 30, 2026 by 88250Moderate -
getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystemGHSA-hf8h-97gm-4x2p published
Jul 29, 2026 by 88250Moderate -
The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given blockGHSA-vg99-7gj7-2fr5 published
Jul 29, 2026 by 88250Moderate -
Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access checkGHSA-53fp-9jmv-227g published
Jul 29, 2026 by 88250Moderate -
getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent routeGHSA-9cqf-hhrq-7v45 published
Jul 29, 2026 by 88250High -
getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filteringGHSA-j4ph-9xwf-wcj4 published
Jul 29, 2026 by 88250Moderate -
The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized, disclosing closed-tab history, search keywords and private document identifiers to anonymous readersGHSA-xp3q-r38w-vgqm published
Jul 29, 2026 by 88250Moderate -
The publish filter for the UI layout omits the password tier, fails open on unresolved documents, and ignores non-editor tabs, disclosing an administrator's open documents and search terms to anonymous readersGHSA-hgfg-j9pg-43xw published
Jul 27, 2026 by 88250Moderate -
The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlockedGHSA-v684-q882-jgmq published
Jul 26, 2026 by 88250High