CVE-2026-86191

SiYuan versions before v3.8.2 are affected by an information disclosure vulnerability in the getAttributeViewKeysByID endpoint. The root cause is that publish readers can enumerate private attribute view key definitions without the system verifying parent database visibility, allowing attackers t...

CVE-2026-86192 SiYuan before v3.8.2 Information Disclosure via Attribute-View

SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization...

CVE-2026-86192

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeys endpoint. The root cause is a failure to properly filter private attribute-view cell values, allowing publish readers to retrieve hidden KeyValues payloads from rows bound to inaccessible doc...

PT-2026-86417

SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization...

CVE-2026-86191: Authorization Bypass Through User-Controlled Key

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve comple...

EUVD-2026-57458

SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns...

SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)

CVE: This vulnerability corresponds to CVE-2026-72800. Summary POST /api/av/getAttributeViewKeysByID returns a database's full column schema with no publish-access filtering, while its sibling getAttributeViewKeys applies the filter for reader sessions. Two further endpoints,...

GHSA-5FHR-F75J-8WR9 SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)

CVE: This vulnerability corresponds to CVE-2026-72800. Summary POST /api/av/getAttributeViewKeysByID returns a database's full column schema with no publish-access filtering, while its sibling getAttributeViewKeys applies the filter for reader sessions. Two further endpoints,...

GHSA-6MCF-G667-W3QV SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)

CVE: This vulnerability corresponds to CVE-2026-72806. Summary FilterViewByPublishAccess, the filter renderAttributeView applies for Reader sessions drops rows using only the hidden/forbidden check and never checks the publish password. Its three sibling filters all check both tiers. As a result,...

SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)

CVE: This vulnerability corresponds to CVE-2026-72806. Summary FilterViewByPublishAccess, the filter renderAttributeView applies for Reader sessions drops rows using only the hidden/forbidden check and never checks the publish password. Its three sibling filters all check both tiers. As a result,...

SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel

CVE: This vulnerability corresponds to CVE-2026-72807. Summary Attribute-view AV template columns are live-evaluated on every render and expose the queryBlocks template function, which runs raw SQL on the read-write database handle SelectBlocksRawStmt, using ?→argument string substitution rather...

SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure

CVE: This vulnerability corresponds to CVE-2026-69086. Summary Four attribute-view read endpoints build a filesystem path from a caller-controlled id/avID and read it without confining the result to the attribute-view storage directory DataDir/storage/av/. On the load file-exists code path there ...

GHSA-7HM9-V7VF-7G4W SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure

CVE: This vulnerability corresponds to CVE-2026-69086. Summary Four attribute-view read endpoints build a filesystem path from a caller-controlled id/avID and read it without confining the result to the attribute-view storage directory DataDir/storage/av/. On the load file-exists code path there ...

EUVD-2026-52279

SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure...

CVE-2026-82652

SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous readers can enumerate invisible content through these three listing mechanisms despite admin configuration marking content unlisted...

CVE-2026-82652

SiYuan before v3.8.1 is affected by an information disclosure vulnerability in publish mode . The application fails to filter invisible-tier content from three listing mechanisms: SQL embed blocks , attribute-view keys , and attribute-view backlinks . As a result, anonymous readers can enumerate ...

PT-2026-83578

SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous readers can enumerate invisible content through these three listing mechanisms despite admin configuration marking content unlisted...

CVE-2026-82652: Exposure of Resource to Wrong Sphere

SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous readers can enumerate invisible content through these three listing mechanisms despite admin configuration marking content unlisted...

EUVD-2026-59800

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary...

CVE-2026-73050

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary...