siyuan-note vulnerabilities

CVEs per yearBy the year they were published

1. 20244
2. 20253
3. 2026212

Newest CVEs

• CVE-2026-118680

  SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias

  siyuan-note · siyuan

  Medium5.9
• CVE-2026-116171

  SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix

  siyuan-note · siyuan

  Medium5.9
• CVE-2026-116170

  SiYuan before v3.8.7 SQL Injection via History Search op and query

  siyuan-note · siyuan

  Medium6.9
• CVE-2026-116169

  SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks

  siyuan-note · siyuan

  Medium5.1
• CVE-2026-116168

  SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool

  siyuan-note · siyuan

  Medium6.9
• CVE-2026-116167

  SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter

  siyuan-note · siyuan

  High7.6
• CVE-2026-116166

  SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting

  siyuan-note · siyuan

  High7.6
• CVE-2026-109310

  SiYuan v3.1.12 before v3.8.6 Denial of Service via getDynamicIcon Template

  siyuan-note · siyuan

  High7.1
• CVE-2026-109309

  SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path

  siyuan-note · siyuan

  Medium6.9
• CVE-2026-105205

  SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo

  siyuan-note · siyuan

  Medium6.9