CVE-2026-73610 in SiYuan
Summary
by MITRE • 08/13/2026
SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document identifiers, and expanded folder paths by calling the getLocalStorage endpoint.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability exists within the SiYuan note-taking application prior to version 3.7.4 where the local storage filter implementation fails to properly sanitize data returned to clients. The flaw specifically affects the getLocalStorage endpoint which is designed to provide local storage information to users. However, the sanitization process only removes three keys from the administrator's complete storage map while leaving sensitive information exposed. This represents a critical information disclosure vulnerability that violates fundamental security principles of least privilege and data protection.
The technical implementation flaw stems from inadequate input validation and output filtering mechanisms within the application's local storage handling logic. When the getLocalStorage endpoint is accessed, it returns an entire storage map structure without proper access control checks or comprehensive sanitization. Attackers can exploit this by making unauthorized calls to the endpoint, thereby gaining access to closed-tab history data, search query logs, private document identifiers, and expanded folder path information that should remain protected. This vulnerability aligns with CWE-200 (Information Disclosure) and CWE-668 (Poor Access Control) categories, demonstrating a clear failure in implementing proper authorization controls.
The operational impact of this vulnerability is significant as it exposes sensitive user data including browsing history and private document references to unauthorized parties. Unauthenticated attackers can access closed-tab history information which reveals user navigation patterns and potentially sensitive content consumption. Search keywords stored in the local storage provide insights into user interests and activities while private document identifiers allow for targeted attacks against specific content. Expanded folder paths reveal organizational structures and data hierarchies that could aid in planning more sophisticated attacks. This vulnerability directly maps to attack techniques described in the MITRE ATT&CK framework under T1083 (File and Directory Discovery) and T1567 (Exfiltration Over Web Service).
Organizations using SiYuan versions prior to 3.7.4 face substantial risk of data exposure and potential privacy violations due to this vulnerability. The information disclosed could include sensitive business documents, personal communications, or proprietary research data that may be valuable for competitive advantage or malicious purposes. Users who have accessed private content through the application may unknowingly expose their activities through the local storage data. The vulnerability's persistence means that even after users close tabs or log out, the exposed data remains accessible to attackers who can make unauthorized requests to the endpoint.
The recommended mitigation strategy involves upgrading to SiYuan version 3.7.4 or later where the local storage filtering has been properly implemented with comprehensive sanitization of all sensitive fields. Security teams should also implement network-level monitoring to detect unusual access patterns to the getLocalStorage endpoint and establish proper access controls that ensure only authenticated administrators can retrieve complete storage maps. Additionally, organizations should conduct regular security assessments of their note-taking applications and implement proper logging mechanisms to track local storage access attempts. The vulnerability underscores the importance of proper input validation and output filtering as outlined in OWASP Top 10 2021 category A03: Data Exposure, where inadequate protection of sensitive data leads to information disclosure risks that can compromise entire systems.