CVE-2026-93921

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.5

Description Insufficient publish access control in the 'getDynamicIcon' endpoint allows users with read-only tokens to access document metadata. By calling this endpoint with the type parameter set to 8 and providing crafted content, an attacker can perform template injection to retrieve block titles, names, aliases, and hierarchical paths of restricted documents.

Recommendations Update SiYuan to version 3.8.5 or later. As a temporary mitigation, restrict access to the 'getDynamicIcon' endpoint.