CyberRota Analysis
AI-GeneratedVersions of SiYuan prior to 3.7.4 are vulnerable due to inadequate filtering of embedded block content, allowing unauthorized access to sensitive information from password-protected or restricted documents. This vulnerability could lead to significant data exposure for organizations using affected versions. Entities managing sensitive content should prioritize patching to mitigate the risk of unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints. Attackers can request published blocks containing embed queries to read content from password-protected, hidden, or forbidden documents without authorization.