CVE-2026-84803
Received Received - Intake

Stored XSS in SiYuan Asset Serving via Unblocked File Extensions

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulnCheck

Description
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84803
EUVD
EUVD-2026-69915

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
siyuan siyuan to 3.8.2 (exc)
siyuan siyuan 3.8.1
siyuan siyuan to 3.8.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan before v3.8.2 has a stored cross-site scripting (XSS) vulnerability due to an incomplete blocklist for file extensions. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf, which are treated as executable media types. This allows JavaScript execution, potentially stealing API tokens and compromising user workspaces.

Detection Guidance

Check SiYuan versions below 3.8.2 for installed instances. Monitor uploaded files with extensions .xht, .ehtml, .xsl, .xbl, or .rdf. Inspect server responses for Content-Disposition headers not set to attachment for these files.

Impact Analysis

An attacker could upload a malicious file to exploit this XSS flaw. If successful, they can execute arbitrary JavaScript in your browser, steal your SiYuan API token, and gain persistent unauthorized access to your workspace. This includes reading or modifying your notebooks and potentially executing remote code if pandoc is available.

Mitigation Strategies

Upgrade SiYuan to version 3.8.2 or later. Expand the asset blocklist to include .xht, .ehtml, .xsl, .xbl, and .rdf. Implement an allow-list for safe media types instead of a blocklist. Review and remove any suspicious uploaded files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84803. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart