SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized

Relationship to GHSA-hgfg-j9pg-43xw That advisory concerned the administrator's live UI layout, and commit 63c7d5474 resolved it by removing FilterUILayoutByPublishIgnore and nulling Conf.UILayout for readers. That fix is correct and complete for the live layout. This report concerns a different...

GHSA-XP3Q-R38W-VGQM SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized

Relationship to GHSA-hgfg-j9pg-43xw That advisory concerned the administrator's live UI layout, and commit 63c7d5474 resolved it by removing FilterUILayoutByPublishIgnore and nulling Conf.UILayout for readers. That fix is correct and complete for the live layout. This report concerns a different...

CVE-2026-110212

Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that...

EUVD-2026-99253

Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that...

CVE-2026-110212 ai-fusion-video through 1.2.0 Path Traversal in Media Upload subDir Parameter

Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that...

CVE-2026-110212 ai-fusion-video through 1.2.0 Path Traversal in Media Upload subDir Parameter

Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that...

CVE-2026-110212

Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that...

CVE-2026-110212

The Stonewuu ai-fusion-video application (through version 1.2.0 ) is vulnerable to a path traversal vulnerability (CWE-22) in the media upload functionality. Authenticated users can leverage the subDir parameter of the POST /api/storage/upload endpoint to write files outside the intended media di...

PT-2026-111836

Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that...

CVE-2026-110212: Improper Limitation of a Pathname to a Restricted Directory

Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that...

Stone Wu Path Traversal Vulnerability

Stone Wu’s Rongguang versions 1.2.0 and earlier have a path traversal vulnerability. This vulnerability stems from the subDir parameter in the POST /api/storage/upload request, which allows for path traversal. The LocalStorageStrategy.storeBytes function does not normalize the sequence of parent...

GO-2026-6624 SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check in github.com/siyuan-note/siyuan/kernel

SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check in github.com/siyuan-note/siyuan/kernel...

GHSA-53FP-9JMV-227G SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check

Summary /api/storage/getOutlineStorage is registered with CheckAuth only and performs no authorization of any kind. Given a document identifier it returns that document's stored outline state, regardless of the document's publish tier. The two write endpoints for the same data, setOutlineStorage...

GHSA-V372-PHQ5-6MX6 Duplicate Advisory: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-53fp-9jmv-227g. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage...

Duplicate Advisory: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-53fp-9jmv-227g. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage...

CVE-2026-73607: Missing Authorization

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents...

PT-2026-105540

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-53fp-9jmv-227g. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage...

CVE-2026-59853

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search criteria from data/storage/criteria.json without the publish-access filtering used by sibling storage endpoints, allowing a publish-mode Reader to read private...

CVE-2025-65112

PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables identity spoofing, privilege escalation, and supply chain...

CVE-2025-65112: Missing Authorization

PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables identity spoofing, privilege escalation, and supply chain...