PT-2026-84676

CVE-2026-84803

Published

2026-09-02

Updated

2026-09-03

Description by

CVSS 3.1

9.0

Critical

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.2

Description Stored cross-site scripting occurs in asset serving because the extension blocklist is incomplete and fails to include script-capable file types. This allows attackers to upload files with extensions such as .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types. Consequently, JavaScript can be executed to steal API tokens and compromise workspaces.

Recommendations Update to version 3.8.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Akokonunes

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers