CVE-2026-40107
SMB Relay via SVG Injection in SiYuan Before
Publication date: 2026-04-09
Last updated on: 2026-04-16
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| b3log | siyuan | to 3.6.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed in SiYuan version 3.6.4. Therefore, the immediate step to mitigate this vulnerability is to upgrade the SiYuan personal knowledge management system to version 3.6.4 or later.
Can you explain this vulnerability to me?
This vulnerability exists in SiYuan, a personal knowledge management system, prior to version 3.6.4. SiYuan configures Mermaid.js with securityLevel set to "loose" and htmlLabels enabled. In this configuration, <img> tags with src attributes are not properly sanitized and end up inside SVG <foreignObject> blocks. The SVG content is then injected into the application using innerHTML without any additional sanitization.
When a user opens a note containing a malicious Mermaid diagram, the Electron client fetches the image URL. On Windows systems, if the URL is protocol-relative (e.g., //attacker.com/image.png), it is interpreted as a UNC path (\\attacker.com\image.png). Windows then attempts to authenticate to this SMB path automatically, sending the victim's NTLMv2 hash to the attacker.
This behavior can lead to credential leakage to an attacker-controlled server. The vulnerability was fixed in SiYuan version 3.6.4.
How can this vulnerability impact me? :
This vulnerability can lead to the leakage of NTLMv2 hashes from a victim's Windows machine to an attacker. Specifically, when a user opens a malicious note containing a crafted Mermaid diagram, their system may automatically send authentication hashes to an attacker-controlled SMB server.
An attacker who obtains these hashes could attempt to use them to authenticate or perform further attacks on the victim's network or systems, potentially leading to unauthorized access or lateral movement within an organization.