CVE-2026-32110CWE-918

SiYuan has a Full-Read SSRF via /api/network/forwardProxy

High · published March 11, 2026

CVSS v3.1
8.3
EPSS
0%
Percentile
33.2
In the wild
Unconfirmed
What it is

SiYuan is a personal knowledge management system. Prior to 3.6.0, the /api/network/forwardProxy endpoint allows authenticated users to make arbitrary HTTP requests from the server. The endpoint accepts a user-controlled URL and makes HTTP requests to it, returning the full response body and headers. There is no URL validation to prevent requests to internal networks, localhost, or cloud metadata services. This vulnerability is fixed in 3.6.0.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00401 · 33.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-03-11T20:38Z
EPSS history
Timeline
  • 11 MAR 20:38Z
    SiYuan has a Full-Read SSRF via /api/network/forwardProxy
    cvelistv5