CVE-2026-73047— siyuan before v3.7.4 Server-Side Template Injection via attribute-view
Quick assessment
Affected
siyuan-note siyuan
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SiYuan是SiYuan团队开源的一款文档管理软件。 SiYuan 3.7.4之前版本存在信息泄露漏洞，该漏洞源于attribute-view Template计算功能使用未修改的Sprig函数映射，暴露了env、expandenv和getHostByName函数，可能导致本地未认证攻击者注入恶意模板计算公式，读取运行siyuan账户的环境变量并执行DNS查询。
Possible ATT&CK Techniques 3 AI
T1048 · Exfiltration Over Alternative Protocol T1057 · Process Discovery T1059 · Command and Scripting InterpreterAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| siyuan-note | siyuan | < 3.7.4 |
affected |
3.7.4 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-73047
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
siyuan before v3.7.4 Server-Side Template Injection via attribute-view
Source: CVE Program / CVE List V5
Vulnerability Description
siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduced in v3.7.0-beta.1). The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and getHostByName functions that were removed elsewhere for CVE-2024-55660. A local, unauthenticated attacker (the kernel binds to 127.0.0.1 by default with no per-UID access control) can inject a malicious Template calculation formula to read environment variables belonging to the account running siyuan — including from a separate, unprivileged OS account — and to perform DNS lookups from the server's network position.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
SiYuan 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SiYuan是SiYuan团队开源的一款文档管理软件。 SiYuan 3.7.4之前版本存在信息泄露漏洞，该漏洞源于attribute-view Template计算功能使用未修改的Sprig函数映射，暴露了env、expandenv和getHostByName函数，可能导致本地未认证攻击者注入恶意模板计算公式，读取运行siyuan账户的环境变量并执行DNS查询。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| siyuan-note | siyuan | 0 ~ 3.7.4 | - |
|
II. Public POCs for CVE-2026-73047
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73047
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-73047 (2)
Same Patch Batch · siyuan-note · 2026-08-15 · 11 CVEs total
| CVE-2026-73046 | 9.8 CRITICAL | SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth |
| CVE-2026-73050 | 9.0 CRITICAL | SiYuan before v3.7.4 Stored XSS via select option color |
| CVE-2026-73043 | 9.0 CRITICAL | SiYuan before v3.7.4 Remote Code Execution via Template Calculation |
| CVE-2026-73042 | 9.0 CRITICAL | SiYuan before v3.7.4 Remote Code Execution via Menu Metadata |
| CVE-2026-73041 | 9.0 CRITICAL | SiYuan before v3.7.4 Remote Code Execution via PDF Annotations |
| CVE-2026-73044 | 9.0 CRITICAL | SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width |
| CVE-2026-73053 | 9.0 CRITICAL | SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji |
| CVE-2026-73052 | 9.0 CRITICAL | SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names |
| CVE-2026-73045 | 7.5 HIGH | SiYuan before 3.7.4 Brute-Force via authFilePublishAccess |
| CVE-2026-73054 | 7.5 HIGH | SiYuan before v3.7.4 Authentication Bypass via WebSocket |
IV. Related Vulnerabilities
Same product: siyuan
-
CVE-2026-62204
SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install -
CVE-2026-60084
SiYuan before v3.7.4 Arbitrary File Deletion via removeTempl -
CVE-2026-60083
SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file -
CVE-2026-59809
SiYuan before v3.8.0 Secret Exfiltration via http_request UR -
CVE-2026-77086
SiYuan before v3.7.4 Path Traversal via packageName
Same vendor: siyuan-note
-
CVE-2026-62204
SiYuan before v3.7.4 Plugin Overwrite via Bazaar Install -
CVE-2026-60084
SiYuan before v3.7.4 Arbitrary File Deletion via removeTempl -
CVE-2026-60083
SiYuan before v3.8.0 Incomplete Path Blocklist via MCP file -
CVE-2026-59809
SiYuan before v3.8.0 Secret Exfiltration via http_request UR -
CVE-2026-77086
SiYuan before v3.7.4 Path Traversal via packageName
Same weakness: CWE-200
-
CVE-2026-72698
Grav CMS before 2.0.16 Information Disclosure via Twig Sandb -
CVE-2026-75099
Apache Allura: Unauthenticated REST disclosure -
CVE-2026-13343
Uninitialised stack memory disclosure in the MIDI 2.0 UMP St -
CVE-2026-78386
Unauthenticated Disclosure of Scraping Credentials and Bypas -
CVE-2026-78378
Redis Glob Pattern Injection Allows Unauthorized Enumeration
V. Comments for CVE-2026-73047
No comments yet