CVE-2026-101092CWE-200information-disclosure

CVE-2026-101092

Medium · published September 29, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
13.8
In the wild
Unconfirmed
What it is

SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to leak detached-row image asset paths and filenames that the rendering endpoint would deny.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00236 · 13.8th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-09-29T02:17Z
References (4)
https://github.com/siyuan-note/siyuan/commit/48229dc76ce4212fe42295393af617947b157c15 · [email protected]https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j9p6-5639-gf4f · [email protected]https://www.vulncheck.com/advisories/siyuan-before-3.8.4-information-disclosure-via-getcurrentattrviewimages · [email protected]https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j9p6-5639-gf4f · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 28 SEP 22:00Z
    SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages
    cvelistv5