rootpwn

medium · CVSS v3 5.3 · CVSS v4 6.9

CVE-2026-105205

SiYuan versions prior to 3.8.5 allow publish‑mode readers to retrieve backlink block IDs and reference counts from password‑protected or pub

Overview

SiYuan versions prior to 3.8.5 allow publish‑mode readers to retrieve backlink block IDs and reference counts from password‑protected or publish‑disabled documents via API calls. This exposes hidden metadata that should remain confidential. The flaw is exploitable by sending POST requests to /api/block/getDocInfo or getDocsInfo for a published document ID.

Description

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo or getDocsInfo for a published document ID to obtain refIDs and refCount of hidden referencing blocks, bypassing the publish confidentiality boundary.

Impact

Confidentiality is compromised: attackers can discover internal block identifiers and reference counts that are not intended for public view. This may aid in mapping document structure or identifying sensitive content. Defenders using SiYuan for knowledge management, especially with publish mode enabled, are at risk.

Remediation

Upgrade SiYuan to version 3.8.5 or later to eliminate the vulnerability. Until patching, disable publish mode for sensitive documents or remove password protection from documents that must remain private. Restrict API access by firewall rules or authentication, and monitor logs for unexpected POST requests to /api/block/getDocInfo or getDocsInfo.

Risk context

The CVSS v3 score of 5.3 and v4 score of 6.9 classify this as medium severity. With no EPSS data, the risk remains moderate; timely patching is recommended but not urgent.

Affected products

  • SiYuan 3.8.x
  • SiYuan 3.7.x
  • SiYuan 3.6.x

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
6.9
EPSS
—

information-disclosure SiYuan publish-mode confidentiality API medium-severity

← All CVEs

Related CVEs

medium

CVE-2026-105144

A flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows. Affected is the function StaticFileRouter::route of the file lib/src/StaticFileRouter.cc of the component Static File Router. Executing a manipulation can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

medium

CVE-2026-97927

The CVE-2026-97927 flaw in the Linux kernel’s UFS filesystem causes an oops during mount teardown when cylinder group reading fails, potentially crashing the kernel. It occurs only when a writable UFS image has a corrupted first cylinder group. The issue is mitigated by applying the kernel patch that reorders root dentry creation.

View analysis

medium

CVE-2026-105096

CVE-2026-105096 is an authorization bypass vulnerability in the Customer Profile API of Omega Solution CoinEx Crypto 2025. By manipulating the ID parameter in the /customer/ endpoint, an attacker can gain unauthorized access to customer data. The flaw is exploitable remotely and has been publicly disclosed.

View analysis

medium

CVE-2026-105124

This CVE affects Vincent Peugnet WCMS up to version 3.18.0, allowing unauthenticated users to inject JavaScript via the login username field and visitor comment field. The injected scripts are rendered unescaped in the admin log viewer and comment URLs, enabling execution with administrator or editor privileges. The vulnerability can lead to cross‑site scripting that compromises the CMS interface.

View analysis