CVE-2026-72808

creationtimestamp| type| source ---|---|--- 2026-09-04 00:35:27+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-v7ph-r5r6-4jcj 2026-09-04 08:32:32+00:00| seen| https://gist.github.com/alon710/4e3a59a46f5538004facf996eb24fc2d...

CVE-2026-72808

SiYuan versions up to and including v3.7.2 fixed in v3.7.4 contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth unlike the /asset...