CVE-2026-74800 in SiYuan
要約
〜によって MITRE • 2026年08月17日
SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace owner opens the asset link.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.