CVE-2026-74800CWE-79cross-site-scripting

CVE-2026-74800

Critical · published August 17, 2026

CVSS v3.1
9.0
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace owner opens the asset link.

The record
Technical detail
CVSS v3.1
9.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
9.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00428 · 36.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-17T15:16Z
References (2)
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mjf3-jwmf-r6wf · [email protected]https://www.vulncheck.com/advisories/siyuan-before-stored-xss-via-assets-endpoint · [email protected]
EPSS history
Timeline
  • 17 AUG 11:04Z
    SiYuan before v3.7.4 Stored XSS via assets endpoint
    cvelistv5