CVE-2026-73047

Received Received - Intake

Siyuan Server-Side Template Injection via Sprig Functions

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: VulnCheck

Description

siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduced in v3.7.0-beta.1). The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and getHostByName functions that were removed elsewhere for CVE-2024-55660. A local, unauthenticated attacker (the kernel binds to 127.0.0.1 by default with no per-UID access control) can inject a malicious Template calculation formula to read environment variables belonging to the account running siyuan — including from a separate, unprivileged OS account — and to perform DNS lookups from the server's network position.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-15

Generated

2026-08-16

AI Q&A

2026-08-16

EPSS Evaluated

N/A

NVD

CVE-2026-73047

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

Siyuan versions up to 3.7.3 have a server-side template injection flaw in the attribute-view Template calculation feature. The template engine uses Sprig's unmodified function map, exposing dangerous functions like env, expandenv, and getHostByName. These functions were previously removed in other parts of the software due to a prior vulnerability (CVE-2024-55660).

Detection Guidance

Detecting this vulnerability requires checking for siyuan versions <= 3.7.3. Run 'siyuan --version' to check the installed version. If the version is 3.7.3 or lower, the system is vulnerable. Additionally, inspect any custom template calculations in attribute views for suspicious formulas that may use Sprig functions like env, expandenv, or getHostByName.

Impact Analysis

A local unauthenticated attacker can exploit this to read environment variables from the account running siyuan, even if it belongs to a separate unprivileged OS user. The attacker can also perform DNS lookups from the server's network position. This could lead to sensitive data exposure and network reconnaissance.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive environment variables, potentially exposing personal or health data. This may violate GDPR's data protection principles and HIPAA's security requirements for safeguarding protected health information.

Mitigation Strategies

Immediately upgrade siyuan to version 3.7.4 or later. If upgrading is not possible, disable the attribute-view Template calculation feature in siyuan settings. Restrict network access to the siyuan kernel binding on 127.0.0.1 by using firewall rules to prevent unauthorized local access.

Hi! I’m here to help you understand CVE-2026-73047. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70