SiYuan discloses an administrator's open documents and search terms to anonymous readers

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to properly restrict administrator workspace state from publish readers. Unauthenticated attackers can retrieve the administrator's open documents, search terms, notebook paths, and private asset locations by calling the getConf endpoint without authentication.

[ Fixes ]Fixes and patches

• github.com/siyuan-note/siyuan/kernel 0.0.0-20260812083335-251596fc0de2Fixed version · GitHub Advisories · go package github.com/siyuan-note/siyuan/kernel: upgrade to 0.0.0-20260812083335-251596fc0de2 or later (affected < 0.0.0-20260812083335-251596fc0de2)

[ Packages ]Affected open-source packages

• github.com/siyuan-note/siyuan/kernel goAffected < 0.0.0-20260812083335-251596fc0de2 · fixed in 0.0.0-20260812083335-251596fc0de2 · GHSA-hgfg-j9pg-43xw

[ References ]References

• github.com/siyuan-note/siyuan/security/advisories/GHSA-hgfg-j9pg-43xwvendor-advisory
• www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-uilayout-filterthird-party-advisory