CyberRota Analysis
AI-GeneratedVersions of SiYuan up to and including v3.7.2 are vulnerable due to an information disclosure flaw in the /api/asset/getFileAnnotation endpoint, which allows unauthorized access to private PDF annotations without proper access checks. This vulnerability can be exploited by anonymous users or those with limited roles to view sensitive highlights and notes from unpublished or password-protected documents. Organizations using affected versions should prioritize patching to v3.7.4 to mitigate the risk of exposing confidential information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth (unlike the /assets/* route, which enforces publish access and password), an anonymous reader (when publish authentication is disabled) or any publish RoleReader who knows an asset path can read the private PDF annotations (highlights and notes) of publish-forbidden, password-protected, or unpublished documents. The issue is limited to non-encrypted notebooks; encrypted-box annotations are not exposed.