Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-101092— SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages

Quick assessment

Affected
siyuan-note siyuan
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 SiYuan v3.8.4 之前的版本中， 端点未能正确实施发布访问检查，导致发布读者可以从未授权数据库中检索图像资产路径。攻击者可以通过相关端点获取未渲染的数据库标识符，并调用该端点，从而泄露由渲染端点本应拒绝的独立行图像资产路径和文件名。

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-101092

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages
Source: CVE Program / CVE List V5
Vulnerability Description
SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to leak detached-row image asset paths and filenames that the rendering endpoint would deny.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
siyuan-note siyuan 0 ~ 3.8.4 -

II. Public POCs for CVE-2026-101092

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-101092

请登录查看更多情报信息。

Other References for CVE-2026-101092 (3)

IV. Related Vulnerabilities

Same product: siyuan
Same vendor: siyuan-note
Same weakness: CWE-200

V. Comments for CVE-2026-101092

No comments yet

Leave a comment