CyberRota Analysis
AI-GeneratedSiyuan versions prior to 3.8.2 are vulnerable due to inadequate publish-access filtering on embedded blocks, allowing attackers with reader access to exploit the /api/export/preview and /api/lute/copyStdMarkdown endpoints. This flaw enables unauthorized retrieval of sensitive content from private or hidden blocks through public documents. Organizations using affected versions should prioritize remediation to prevent potential data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. Attackers with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by accessing public documents containing embed queries that select those blocks.