PT-2026-88947
CVE-2026-87809
·
تاريخ النشر
2026-09-09
·
تاريخ التحديث
2026-09-18
الوصف من
CVSS 4.0
7.1
عاليةالمقاييسAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Siyuan versions prior to 3.8.2
Description
Insufficient publish-access filtering for embedded blocks occurs during rendering. Users with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by accessing public documents that contain embed queries selecting those blocks. This issue affects the '/api/export/preview' and '/api/lute/copyStdMarkdown' endpoints.
Recommendations
Update to version 3.8.2 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾