SiYuan: Information disclosure of protected database rows via export preview
Summary
SiYuan before 3.8.5 allows a publish reader to read database rows that belong to password-protected or publish-disabled documents. The /api/export/preview endpoint returns the primary-key text and all cell values of such rows when a public document embeds a database view that aggregates them. The attack requires only publish-reader access; if publish Basic Auth is disabled, the reader can be anonymous. A reader password does not protect the affected rows.
Affected
- SiYuan versions before 3.8.5 (affected range reported as 0 to less than 3.8.5)
- Pre-release builds 3.8.5-beta.1, 3.8.5-beta.2, 3.8.5-beta.3 and 3.8.5-beta.5 are listed as affected in OSV; confirm against the advisory
Fixed in
- SiYuan 3.8.5 (confirm the exact build against the vendor advisory)
Workaround
- No vendor-documented workaround. Status: unknown.
- Turning off the publish service or limiting it to trusted readers reduces exposure but does not fix the flaw.
Exploitation
- Exploited in the wild: none found in the consulted sources; CISA KEV not verified.
- Public proof of concept: unknown. CISA SSVC lists exploitation as 'poc' and automatable as 'yes'.
- EPSS: not found.
Our recommendation
- Upgrade SiYuan to 3.8.5 or later and confirm the exact build, including pre-release builds.
- Until the upgrade, disable the publish service or restrict it to trusted readers.
- Review which published documents embed database views and remove confidential database content from public pages.
- Check whether publish access logs show requests to /api/export/preview.
- Risk is low to medium for private use and high for an internet-facing publish site with confidential content.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-778g-gq49-fxxj github.com
- VulnCheck advisory: SiYuan before 3.8.5 Information Disclosure via /api/export/preview www.vulncheck.com
- OSV: CVE-2026-104410 osv.dev
- OffSeq Radar: CVE-2026-104410 radar.offseq.com
- Strix: CVE-2026-104410 www.strix.ai
- NixOS nixpkgs issue 569840 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:04.
Original description (NVD)
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain protected rows' primary-key text and cell values.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.