CVE-2026-72804

Received Received - Intake

SiYuan Path Traversal in Password-Protected Documents

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: VulnCheck

Description

SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of password-protected documents. Attackers can call these endpoints without supplying a password to read protected document content and the complete reference topology.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-72804

EUVD

EUVD-2026-57464

Affected Vendors & Products

Vendor	Product	Version / Range
siyuan	siyuan	to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

CVE-2026-72804 is an authentication bypass vulnerability in SiYuan note-taking software versions before v3.7.4. It affects the getGraph and getLocalGraph endpoints, which fail to validate publish-password tiers. This allows anonymous users to retrieve block-level content and reference topology of password-protected documents without supplying the correct password.

Detection Guidance

To detect this vulnerability, check if your SiYuan instance is running a version before v3.7.4. Use commands like 'curl -X GET http://localhost:6806/api/graph/getGraph' or 'curl -X GET http://localhost:6806/api/graph/getLocalGraph' to test if password-protected document content is accessible without authentication.

Impact Analysis

Attackers can exploit this flaw to read sensitive information from password-protected documents without authentication. This includes accessing block content and the complete link structure of protected notes, potentially exposing confidential data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to exposure of protected information without proper access controls.

Mitigation Strategies

Immediately upgrade SiYuan to version v3.7.4 or later. If upgrading is not possible, restrict network access to the SiYuan application endpoints or disable the vulnerable graph endpoints until patched.

Hi! I’m here to help you understand CVE-2026-72804. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70