CVE-2026-73041— 思源笔记 v3.7.4 远程代码执行漏洞
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| siyuan-note | siyuan | < 3.7.4 | affected |
3.7.4 | unaffected |
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-73041の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
SiYuan before v3.7.4 Remote Code Execution via PDF Annotations
ソース: CVE Program / CVE List V5
脆弱性説明
SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
ソース: CVE Program / CVE List V5
脆弱性タイプ
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
ソース: CVE Program / CVE List V5
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| siyuan-note | siyuan | 0 ~ 3.7.4 | - |
II. CVE-2026-73041の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-73041のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-73041 厂商安全公告 (2)
Same Patch Batch · siyuan-note · 2026-08-15 · 11 CVEs total
| CVE-2026-73046 | 9.8 CRITICAL | SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth |
| CVE-2026-73050 | 9.0 CRITICAL | SiYuan before v3.7.4 Stored XSS via select option color |
| CVE-2026-73043 | 9.0 CRITICAL | SiYuan before v3.7.4 Remote Code Execution via Template Calculation |
| CVE-2026-73042 | 9.0 CRITICAL | SiYuan before v3.7.4 Remote Code Execution via Menu Metadata |
| CVE-2026-73044 | 9.0 CRITICAL | SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width |
| CVE-2026-73053 | 9.0 CRITICAL | SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji |
| CVE-2026-73052 | 9.0 CRITICAL | SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names |
| CVE-2026-73045 | 7.5 HIGH | SiYuan before 3.7.4 Brute-Force via authFilePublishAccess |
| CVE-2026-73054 | 7.5 HIGH | SiYuan before v3.7.4 Authentication Bypass via WebSocket |
| CVE-2026-73047 | 6.2 MEDIUM | siyuan before v3.7.4 Server-Side Template Injection via attribute-view |
IV. 関連脆弱性
同じ製品: siyuan
- CVE-2026-74868
SiYuan before 3.7.4 Brute-Force Authentication via Publish S - CVE-2026-74867
SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth - CVE-2026-74802
SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network prox - CVE-2026-74801
SiYuan before 3.7.4 Local Privilege Escalation via elevator. - CVE-2026-74800
SiYuan before v3.7.4 Stored XSS via assets endpoint
同じベンダー: siyuan-note
- CVE-2026-74868
SiYuan before 3.7.4 Brute-Force Authentication via Publish S - CVE-2026-74867
SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth - CVE-2026-74802
SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network prox - CVE-2026-74801
SiYuan before 3.7.4 Local Privilege Escalation via elevator. - CVE-2026-74800
SiYuan before v3.7.4 Stored XSS via assets endpoint
同じ弱点: CWE-79
- CVE-2026-75078
SourceCodester Class and Exam Timetabling System BSHRM1.php - CVE-2026-75077
SourceCodester Class and Exam Timetabling System BSCE2.php c - CVE-2026-75531
Stored Cross-Site Scripting in URL Observables via Lookyloo - CVE-2026-75529
Stored Cross-Site Scripting via MIME-Type Confusion in PDF D - CVE-2026-63670
ApostropheCMS: Mutation-XSS / allowedTags bypass via literal
V. CVE-2026-73041へのコメント
まだコメントはありません