CVE-2026-84803 in SiYuan
Summary
by MITRE • 09/02/2026
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in SiYuan versions prior to 3.8.2 represents a critical stored cross-site scripting flaw rooted in the application's asset serving mechanism. This security defect arises from an incomplete extension blocklist that fails to adequately restrict file types capable of being interpreted as executable scripts by web browsers or associated media handlers. Specifically, the system allows the upload and subsequent hosting of files with extensions such as .xht, .ehtml, .xsl, .xbl, and .rdf. These specific file formats are often mapped to MIME types that trigger script execution within the client-side environment when served through the application's asset endpoint. The core technical failure lies in the server-side validation logic which relies on a static list of blocked extensions rather than implementing robust content-type verification or strict allow-listing practices, thereby permitting malicious payloads to be persisted and delivered to victims.
From an operational perspective, this vulnerability enables attackers to inject persistent JavaScript code into the application's context through legitimate file upload channels. Once uploaded, these files are served with media types that instruct the browser to execute their contents as scripts rather than treating them as static data or images. This persistence mechanism distinguishes it from reflected XSS attacks, allowing the malicious script to remain active until manually removed by an administrator or user. The primary impact of this flaw is the potential for complete compromise of user workspaces and sensitive API tokens stored within the browser's local storage or session cookies. An attacker can craft a payload that exfiltrates authentication credentials, reads private notes, or performs actions on behalf of the victim without their knowledge, effectively bypassing standard access controls by leveraging the trusted context of the application.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as a common cause for cross-site scripting flaws. Furthermore, in terms of tactical classification under the MITRE ATT&CK framework, this incident maps to T1059, specifically subcategories involving command and script interpreters such as JavaScript or HTML-based execution vectors like T1027 which covers obfuscated files or information. The exploitation chain typically involves initial access via file upload followed by persistence through stored scripts and credential theft leading to privilege escalation within the application's scope.
Mitigation strategies must focus on hardening the asset serving pipeline. Immediate remediation requires updating SiYuan to version 3.8.2 or later where these specific extensions are properly blocked. For environments unable to upgrade immediately, administrators should implement a strict allow-list approach for file uploads rather than relying solely on block lists which can be bypassed by unknown variants. Additionally, configuring the web server or application layer to enforce Content-Type headers that match actual file content and preventing browsers from executing scripts served as static assets is crucial. Implementing a robust Content Security Policy with nonces or strict-dynamic directives can also mitigate the impact of any successfully injected script by restricting execution sources. Regular auditing of MIME type mappings and ensuring that uploaded files are sanitized to remove executable code before storage will further reduce the attack surface associated with file handling operations.