Siyuan-note vulnerabilities
220 CVEs and advisories name Siyuan-note as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-23850SiYuan vulnerable to arbitrary file read
- CVE-2026-23847SiYuan Vulnerable to Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon
- CVE-2026-23645SiYuan Vulnerable to Stored Cross-Site Scripting (XSS) via Unrestricted SVG File Upload
- CVE-2025-68948SiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session Secret
- CVE-2025-67488SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE
- CVE-2025-21609SiYuan has an arbitrary file deletion vulnerability
- CVE-2024-55660SiYuan has an SSTI via /api/template/renderSprig
- CVE-2024-55659SiYuan has an arbitrary file write in the host via /api/asset/upload
- CVE-2024-55658SiYuan has an arbitrary file read and path traversal via /api/export/exportResources
- CVE-2024-55657SiYuan has an arbitrary file read via /api/template/render