CVE-2026-82650

SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function (kernel/model/template.go), reachable via the POST /api/template/render endpoint. The endpoint restricts the supplied path to the workspace directory (util.IsAbsPathInWorkspace) but, unli...

EUVD-2026-68236

SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function kernel/model/template.go, reachable via the POST /api/template/render endpoint kernel/api/template.go. The endpoint restricts the supplied path only to the workspace directory...

CVE-2024-25600-WordPress-Bricks-Builder-RCE-PoC

CVE-2024-25600 — WordPress Bricks Builder RCE PoC Nicht authentifizierte Remote-Code-Ausführung-Sicherheitslücke in WordPress Bricks Builder id uid=33www-data gid=33www-data groups=33www-data...

PT-2026-42989

A security flaw has been discovered in SourceCodester Indian Invoicing System up to 0.x/1.0. The impacted element is an unknown function of the file /Invoicing/add order.php of the component Invoice Template Render Database-Backed. The manipulation of the argument customer name results in cross...

PT-2026-29423

Summary An unauthenticated attacker can submit a guest FAQ with an email address that is syntactically valid per RFC 5321 quoted local part yet contains raw HTML — for example "alert1"@evil.com. PHP's FILTER VALIDATE EMAIL accepts this email as valid. The email is stored in the database without...

CVE-2026-32704

SiYuan is a personal knowledge management system. Prior to 3.6.1, POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database and exfiltrate all note content, metadata, and custom attributes. Thi...

EUVD-2024-3525

Malicious code in bioql PyPI...

CVE-2024-55657

SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's /api/template/render endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. Version 3.1.16...

SUSE CVE-2024-55657

SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's /api/template/render endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. Version 3.1.16...

CVE-2024-55657 SiYuan has an arbitrary file read via /api/template/render

SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's /api/template/render endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. Version 3.1.16...

PT-2024-36571 · Siyuan · Siyuan

Name of the Vulnerable Software and Affected Versions: SiYuan versions prior to 3.1.16 Description: An arbitrary file read issue exists due to the absence of proper validation on the path parameter in the "/api/template/render" endpoint. This allows attackers to access sensitive files on the host...