CVE-2026-101092

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4

Description Insufficient publish-access checks in the 'getCurrentAttrViewImages' endpoint allow users with publish reader permissions to retrieve image asset paths from unauthorized databases. By providing an unrendered database identifier obtained via related endpoints, an attacker can leak filenames and image asset paths of detached rows that are normally restricted by the rendering endpoint.

Recommendations Update to version 3.8.4 or later. As a temporary mitigation, restrict access to the 'getCurrentAttrViewImages' endpoint.