CVE-2026-101092

5.3 MEDIUMpublic exploit available

Published 2026-09-28 · Updated 2026-09-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to leak detached-row image asset paths and filenames that the rendering endpoint would deny.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-200

Public exploit & PoC references

https://github.com/siyuan-note/siyuan/commit/48229dc76ce4212fe42295393af617947b157c15
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j9p6-5639-gf4f

All references

https://github.com/siyuan-note/siyuan/commit/48229dc76ce4212fe42295393af617947b157c15
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j9p6-5639-gf4f
https://www.vulncheck.com/advisories/siyuan-before-3.8.4-information-disclosure-via-getcurrentattrviewimages

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-100241
UNSCOREDCVE-2026-100244
MEDIUMCVE-2026-100286
UNSCOREDCVE-2026-100377
UNSCOREDCVE-2026-100379PoC
MEDIUMCVE-2026-100418PoC
MEDIUMCVE-2026-100528PoC
HIGHCVE-2026-100543PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.