SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter

SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting

SiYuan before v3.8.2 Stored XSS via Bazaar iconURL

SiYuan has an Incomplete Fix for IsSensitivePath Denylist Allows File Read from /opt, /usr, /home

SiYuan importStdMd: unvalidated localPath imports arbitrary host directories as persistent notes

SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install

SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template

SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path

SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations

Siyuan before v3.8.2 Information Disclosure via Export Preview

SiYuan before v3.8.2 Information Disclosure via Attribute-View

SiYuan before v3.8.2 Path Traversal via symlink in file API

SiYuan before v3.8.2 Unbounded Session Creation via Basic Auth

SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch

SiYuan through 3.8.1 Authorization Bypass via getFile

SiYuan before v3.7.4 Missing Authorization via refreshBacklink

SiYuan before v3.7.2 Path Traversal via /export/temp/

SiYuan: Publish-mode Reader can exfiltrate private saved-search Criteria via /api/storage/getCriteria (missing publish-access filter)

SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering

SiYuan has an Arbitrary File Read in its Desktop Publish Service

SiYuan renderSprig: missing admin check allows any user to read full workspace DB

SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality

SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool

siyuan before v3.7.4 Server-Side Template Injection via attribute-view

SiYuan: Reflected XSS via SVG namespace prefix bypass in SanitizeSVG ( getDynamicIcon, unauthenticated )

SiYuan has a SanitizeSVG bypass via data:text/xml in getDynamicIcon (incomplete fix for CVE-2026-29183)

SiYuan has a SVG Sanitizer Bypass via Whitespace in `javascript:` URI — Unauthenticated XSS

SiYuan has a SVG Sanitizer Bypass via `<animate>` Element — Unauthenticated XSS

SiYuan: Unauthenticated reflected SVG XSS in `/api/icon/getDynamicIcon` (`type=8`) enables arbitrary JavaScript execution

SiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon

SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload

SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie

SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon

SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo

SiYuan before v3.7.4 Information Disclosure via authFilePublishAccess

SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks

SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID

SiYuan before v3.7.4 Information Disclosure via Local Storage

SiYuan before v3.7.4 Information Disclosure via getBookmarkLabels

SiYuan before v3.7.4 Information Disclosure via getOutlineStorage

SiYuan before v3.7.4 Information Disclosure via getRefIDs

SiYuan before v3.7.4 Path Traversal via getUniqueFilename

SiYuan before v3.7.4 Information Disclosure via getFileAnnotation

SiYuan before v3.7.4 Authentication Bypass via Attribute View

SiYuan before v3.7.4 Information Disclosure via Block Endpoints

SiYuan before v3.7.4 Information Disclosure via getBlockAttrs

SiYuan before v3.7.4 Information Disclosure via Unfiltered API

SiYuan before v3.7.4 Information Disclosure via Path Resolution

SiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatus

SiYuan before v3.7.4 Access Control Bypass via Static Routes