Live › vulnerability › GHSA-3cm4-ccvw-6xr6
Go to dashboardSiYuan's kernel exposes history and repo diff endpoints that can return historical snapshots of data/.siyuan/publishAccess.json and data/templates/* files. An attacker who can reach those endpoints can read past versions of publish access settings and templates.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/siyuan-note/siyuan/kernel | go | < 0.0.0-20260816034002-035bf9a8c311 | 0.0.0-20260816034002-035bf9a8c311 |
Unknown from the sources.
Update github.com/siyuan-note/siyuan/kernel to version 0.0.0-20260816034002-035bf9a8c311 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiYuan: /history/*path and /repo/diff/path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/ in github.com/siyuan-note/siyuan/kernel
This page as .md · .json · in your agent: get_signal("GHSA-3cm4-ccvw-6xr6")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.