CVE-2026-73610
MediumCVSS 5.8Summary
SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document identifiers, and expanded folder paths by calling the getLocalStorage endpoint.
Risk Assessment
Unauthorized individuals can obtain sensitive information about administrator activities and document structure, potentially leading to privacy breaches and data leakage.
Recommendation
It is recommended to upgrade SiYuan to version v3.7.4 or later, which includes the fix restricting access to local storage data.
Original NVD description (English source)
SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document identifiers, and expanded folder paths by calling the getLocalStorage endpoint.