Alham-Rizvi

A stored cross-site scripting issue exists because the `rex media service` moves uploaded SVG files into the public media folder before the sanitization process is complete. Authenticated users with mediapool upload permissions can exploit this by racing the sanitizer or exhausting memory limits, allowing malicious scripts within SVG files to be served publicly and executed in the backend sessions of other users.

Reference implementations of `ClientConfigurationEndpoint.authenticate client()` and `ClientConfigurationEndpoint.check permission()` look up a target client using `client id` data from the request and verify if the target is editable, but fail to verify if the `request.credential` belongs to that target client. This allows a client with any valid registration access token to read, modify, or delete the registration of another client. Modifying `redirect uris` can lead to authorization code or token interception, and deleting registrations can result in a denial of service for the affected clients.

A missing authorization issue exists in the backup addon export feature. This allows non-admin users who possess the `backup[export]` permission to export sensitive database tables, including `rex user` and `rex user session`. An attacker can exploit this to obtain plaintext session IDs and stay-logged-in keys to hijack administrator accounts, or retrieve password hashes for offline cracking.

The default `JWTBearerGrant.get audiences()` function returns an empty list, which leads `JWTBearerGrant.verify claims()` to only check for the existence of an `aud` claim without verifying if it matches the current authorization server. This allows an attacker with a legitimate assertion for a different service to present it to a server that shares the same signing key and uses the default grant, enabling the acquisition of an access token across a trust boundary.

When the opt-in Web Clipper server is enabled in Joplin Desktop, the server in `packages/lib/ClipperServer.ts` sends an `Access-Control-Allow-Origin: *` header. This allows arbitrary websites to call the 'POST /auth' and 'GET /auth/check' API endpoints because the pairing endpoints do not reject HTTP or HTTPS origins. Since the desktop confirmation dialog does not identify the requesting origin, a user who approves the prompt grants the attacking page a permanent API token. This token allows continuous read and write access to notes, folders, tags, resources, and master keys.

In the `packages/server/src/models/TokenModel.ts` file, CSRF, account-confirmation, email-change, and password-reset tokens are stored without a designated purpose. Additionally, the `UserModel.resetPassword()` function in `packages/server/src/models/UserModel.ts` accepts any token returned by `TokenModel.userFromToken()`. An attacker who obtains a victim's CSRF or confirmation token via a separate disclosure channel can submit it to the public password-reset endpoint to change the victim's password, which results in the deletion of existing sessions and API applications.

Authenticated users can cause a denial of service by sending oversized WebSocket messages to the '/api/command' endpoint. The application fails to limit the message size before verifying permissions, which allows the buffering of arbitrarily large messages. This process can exhaust the server heap memory, leading to a system crash, regardless of the `EnableExec` setting or the user's Execute permission.

A stored cross-site scripting issue exists in the search asset preview feature. The application fails to escape indexed asset content before inserting it into the Document Object Model (DOM) using the `innerHTML` property. This allows attackers who can place crafted text assets in a workspace to execute JavaScript within the SiYuan origin when a victim previews the assets, potentially leading to authenticated API requests and workspace manipulation.

Insufficient filtering of private attribute-view cell values occurs in the 'getAttributeViewKeys' endpoint. This allows publish readers to retrieve hidden `KeyValues` payloads from rows linked to documents they cannot access, leading to unauthorized exposure of private database contents.

An information disclosure issue exists in the 'getAttributeViewKeysByID' endpoint. This allows users with publish reader permissions to enumerate private attribute view key definitions without the system verifying the visibility of the parent database. An attacker can use this endpoint to retrieve complete key schemas, including sensitive field names and relation definitions, from hidden databases.

A stored cross-site scripting issue exists in the `tHtml()` function (src/lib/stores/i18n.svelte.ts), which inserts untrusted parameters like usernames into translation templates before parsing them as markdown. Because the server-side validation function `isValidUsername()` does not block characters such as <, >, ", or ', an attacker can register a username containing an HTML payload. This payload executes in the authenticated session of an administrator when they view UI elements that render the username via `tHtml()`, such as the 'page is locked' editor notice or the two-factor force-disable confirmation prompt.

The publish-service Basic Auth handler contains an unbounded session creation issue. Authenticated attackers can repeatedly authenticate using valid credentials to generate persistent session entries that lack expiry or capacity limits. This leads to continuous process memory growth, resulting in a denial of service.

Insufficient sanitization of output from the `marked.parse()` function before it is injected into the Document Object Model (DOM) via Svelte's `{@html}` directive within the MarkdownEditor and MarkdownModal components. This allows attackers to inject `javascript:` URI schemes into plugin or theme changelogs, leading to arbitrary code execution in authenticated administrator sessions.

The request-concurrency middleware contains an unbounded resource consumption issue where mutex entries are retained for every unique request path without an eviction mechanism. Unauthenticated attackers can exploit this by sending a large number of unique request paths, leading to a permanent increase in process memory and synchronization overhead, which degrades system availability.

An authorization bypass exists in the '/api/file/getFile' endpoint. Users with a reader role can retrieve files from notebooks configured as `Visible:false` if they know the hidden notebook identifier and the file path. This allows unauthorized access to private workspace files, including internal configuration and notebook metadata.

An information disclosure issue exists in the reader-accessible POST '/api/transactions/undoState' endpoint. The endpoint returns the `peekMutatedRootIDs` list from the global undo-log stack for a caller-supplied `root ID` without applying publish-access visibility filtering. An authenticated reader who knows the root ID of a visible document can obtain the internal root IDs of other documents, including private or unpublished ones, that were modified in the same cross-document transaction. This discloses internal identifiers and cross-document relationships, although document body contents are not directly exposed.

Improper escaping of block name, alias, and memo fields occurs within the hint, backlink, and breadcrumb rendering functions. This allows an attacker to inject HTML or script tags into a block's name, which are then executed when another user views documents that reference or display that block.

A stored cross-site scripting issue exists in the `confirmDialog()` function. This occurs because unescaped package names and notebook names are interpolated directly into innerHTML assignments. An attacker can submit malicious bazaar packages containing HTML or script payloads in the name field, which then execute in the browser of a user when they uninstall packages or unlock encrypted notebooks.

An authenticated attacker can exploit a path traversal and sensitive file exposure issue through the `RenderTemplate()` function. This is reachable via the 'POST /api/template/render' endpoint. While the system restricts paths to the workspace directory using `util.IsAbsPathInWorkspace`, it fails to apply a sensitive-path exclusion blocklist. This allows the unauthorized reading of sensitive workspace files, such as `conf/conf.json`, which stores the API token and cookie signing key.

An issue exists in `kernel/server/serve.go` where the `IsForbiddenAbsPath` guard is not applied to the '/history/*path' and '/repo/diff/*path' endpoints. Although these endpoints require administrator authentication, they construct file paths independently. This allows an authenticated administrator to retrieve historical snapshots of sensitive files, such as `data/.siyuan/publishAccess.json`, which contains plaintext publish-mode passwords, and files located under `data/templates/`.