Vulnerability · Published Mar 11, 2026 · Assigned by GitHub_M

CVE-2026-32110SiYuan has a Full-Read SSRF via /api/network/forwardProxy

High 8.3

In plain English

A high-severity server-side request forgery in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.4%top 68.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiYuan is a personal knowledge management system. Prior to 3.6.0, the /api/network/forwardProxy endpoint allows authenticated users to make arbitrary HTTP requests from the server. The endpoint accepts a user-controlled URL and makes HTTP requests to it, returning the full response body and headers. There is no URL validation to prevent requests to internal networks, localhost, or cloud metadata services. This vulnerability is fixed in 3.6.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/siyuan-note/siyuan/kernel	3.6.0	GHSA-56cv-c5p2-j2wg
Go	github.com/siyuan-note/siyuan/kernel	no fix listed	GO-2026-4685

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	< 3.6.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-56cv-c5p2-j2wg x_refsource_CONFIRM