CVE-2026-74800— SiYuan before v3.7.4 Stored XSS via assets endpoint
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| siyuan-note | siyuan | < 3.7.4 | affected |
3.7.4 | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-74800
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SiYuan before v3.7.4 Stored XSS via assets endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace owner opens the asset link.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| siyuan-note | siyuan | 0 ~ 3.7.4 | - |
II. Public POCs for CVE-2026-74800
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74800
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-74800 (2)
- 🔗 SiYuan before v3.7.4 Stored XSS via assets endpoint | Advisories | VulnCheckthird-party-advisory
Same Patch Batch · siyuan-note · 2026-08-17 · 7 CVEs total
| CVE-2026-74799 | 9.3 CRITICAL | SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure |
| CVE-2026-74798 | 8.7 HIGH | SiYuan kernel Path Traversal via database_clean MCP tool |
| CVE-2026-74801 | 8.2 HIGH | SiYuan before 3.7.4 Local Privilege Escalation via elevator.exe |
| CVE-2026-74802 | 8.2 HIGH | SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy |
| CVE-2026-74868 | 7.5 HIGH | SiYuan before 3.7.4 Brute-Force Authentication via Publish Service |
| CVE-2026-74867 | 4.2 MEDIUM | SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth |
IV. Related Vulnerabilities
Same product: siyuan
- CVE-2026-74906
SiYuan before v3.7.4 Incorrect Authorization via Publish Acc - CVE-2026-74905
SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass - CVE-2026-74904
SiYuan before v3.7.4 Missing Authorization via block API - CVE-2026-74902
SiYuan before v3.7.4 XSS-to-RCE via malicious filename uploa - CVE-2026-74903
SiYuan before v3.7.4 Insufficient Access Control via spinBlo
Same vendor: siyuan-note
- CVE-2026-74906
SiYuan before v3.7.4 Incorrect Authorization via Publish Acc - CVE-2026-74905
SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass - CVE-2026-74904
SiYuan before v3.7.4 Missing Authorization via block API - CVE-2026-74903
SiYuan before v3.7.4 Insufficient Access Control via spinBlo - CVE-2026-74902
SiYuan before v3.7.4 XSS-to-RCE via malicious filename uploa
Same weakness: CWE-79
- CVE-2026-73336
Joomla! Core - [20260806] - XSS through schema.org outputs i - CVE-2026-45116
MyBB: Profile field type confusion XSS - CVE-2026-45115
MyBB: Buddy/ignore list username XSS - CVE-2026-55839
Kestra: Stored XSS via custom Markdown [[link]] attribute in - CVE-2026-45733
Trilium: Stored XSS in note icon rendering leads to Remote C
V. Comments for CVE-2026-74800
No comments yet