siyuan-note siyuan

CVE-2026-30869 Critical 9.3 SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage 1.2%
CVE-2026-30926 High 7.1 SiYuan Note publish service authorization bypass allows low-privilege users to modify notebook content 0.3%
CVE-2026-29183 Critical 9.3 SiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript execution 0.7%
CVE-2026-29073 Medium 5.7 SiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database access 0.4%
CVE-2026-25992 High 7.5 SiYuan has a File Read Interface Case Bypass Vulnerability 0.6%
CVE-2026-25647 Medium 4.6 Lute has a Stored Cross-Site Scripting (XSS) via Markdown hyperlink 0.2%
CVE-2026-25539 Critical 9.1 SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE 1.1%
CVE-2026-23852 Medium 5.8 SiYuan vulnerable to Stored XSS / RCE via `setBlockAttrs` icon attribute 0.8%
CVE-2026-23851 High 8.3 SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality 0.5%
CVE-2026-23850 High 7.8 SiYuan vulnerable to arbitrary file read 0.6%
CVE-2026-23847 Low 2.1 SiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon 0.3%
CVE-2026-23645 Medium 5.3 SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload 0.3%
CVE-2025-68948 Medium 6.9 SiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session Secret 0.2%
CVE-2025-67488 High 7.8 SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE 0.4%
CVE-2025-21609 High 8.7 SiYuan has an arbitrary file deletion vulnerability 0.6%
CVE-2024-55660 Medium 6.9 SiYuan has an SSTI via /api/template/renderSprig 0.6%
CVE-2024-55659 High 8.7 SiYuan has an arbitrary file write in the host via /api/asset/upload 0.4%
CVE-2024-55658 High 8.7 SiYuan has an arbitrary file read and path traversal via /api/export/exportResources 0.6%
CVE-2024-55657 High 8.7 SiYuan has an arbitrary file read via /api/template/render 0.7%