CyberRota Analysis
AI-GeneratedVersions of SiYuan prior to v3.7.4 are vulnerable to an information disclosure flaw in the UILayout filter, allowing unauthenticated attackers to access sensitive administrator data, including open documents and private asset locations, via the getConf endpoint. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized data exposure. This vulnerability is particularly relevant for system administrators and security teams managing SiYuan deployments.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to properly restrict administrator workspace state from publish readers. Unauthenticated attackers can retrieve the administrator's open documents, search terms, notebook paths, and private asset locations by calling the getConf endpoint without authentication.