CyberRota Analysis
AI-GeneratedThe vulnerability in SiYuan allows unauthorized access to private document paths and metadata through the /api/storage/getCriteria endpoint, which lacks proper access controls. This could enable a publish-mode Reader to exploit the flaw and retrieve sensitive information from unpublished documents. Users of versions prior to 3.7.1 should prioritize updating their systems to mitigate potential data exposure risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search criteria from data/storage/criteria.json without the publish-access filtering used by sibling storage endpoints, allowing a publish-mode Reader to read private document paths, notebook, document, and block IDs, and search and replace keywords for unpublished documents. This issue is fixed in versions 3.7.1.