24 matches found
CVE-2026-91816
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been released, resulting in a use-after-free condition and applicati...
CVE-2026-91816
Foxit PDF Editor/Reader is susceptible to a use-after-free vulnerability in its handling of PDF annotations . The vulnerability is triggered by reentrant annotation deletion initiated through embedded JavaScript , which causes the application to access an annotation object after it has been relea...
CVE-2026-91818
A use-after-free vulnerability exists in Foxit PDF Editor/Reader 's JavaScript handling of PDF annotations. The root cause is reentrant page-event processing during annotation enumeration, which may release the associated page object; subsequent access to this object results in an application cra...
EUVD-2026-85156
A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash...
Exploit for Out-of-bounds Read in Foxit Pdf_Editor
CVE-2024-30350 Research Notes Overview CVE-2024-30350 is...
GO-2026-6406 SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode) in github.com/siyuan-note/siyuan/kernel
SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents publish mode in github.com/siyuan-note/siyuan/kernel...
EUVD-2026-57409
SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents publish mode...
SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)
CVE: This vulnerability corresponds to CVE-2026-72808. Summary The /api/asset/getFileAnnotation endpoint returns the content of .sya PDF-annotation files with no publish-access check. It is gated by CheckAuth only, so it is reachable by the publish RoleReader token and by the anonymous account wh...
GHSA-V7PH-R5R6-4JCJ SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)
CVE: This vulnerability corresponds to CVE-2026-72808. Summary The /api/asset/getFileAnnotation endpoint returns the content of .sya PDF-annotation files with no publish-access check. It is gated by CheckAuth only, so it is reachable by the publish RoleReader token and by the anonymous account wh...
CVE-2026-73041 SiYuan before v3.7.4 Remote Code Execution via PDF Annotations
SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF...
CVE-2026-73048
SiYuan before v3.7.4 contains an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint, which returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by using annotation identif...
EUVD-2026-58654
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by supplying annotati...
PT-2026-72009
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An information disclosure issue exists in the 'getRefIDsByFileAnnotationID' endpoint. The system returns block identifiers that cite PDF annotations without applying publish-access filtering. This...
Duplicate Advisory: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v7ph-r5r6-4jcj. This link is maintained to preserve external references. Original Description SiYuan versions up to and including v3.7.2 fixed in v3.7.4 contain an information disclosure vulnerability in the...
CVE-2026-72808
SiYuan versions up to and including v3.7.2 fixed in v3.7.4 contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth unlike the /asset...
CVE-2026-72808 SiYuan before v3.7.4 Information Disclosure via getFileAnnotation
SiYuan versions up to and including v3.7.2 fixed in v3.7.4 contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth unlike the /asset...
CVE-2026-72808
SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint. The endpoint returns .sya PDF-annotation content without a publish-access check, being gated only by CheckAuth, which may allow an anonymous r...
CVE-2026-72808 SiYuan before v3.7.4 Information Disclosure via getFileAnnotation
SiYuan versions up to and including v3.7.2 fixed in v3.7.4 contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth unlike the /asset...
CVE-2026-72808
SiYuan versions up to and including v3.7.2 fixed in v3.7.4 contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth unlike the /asset...