CVE-2026-93921

Deferred Deferred - Pending Action

SiYuan Path Traversal via getDynamicIcon Endpoint

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: VulnCheck

Description

SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of restricted documents via template injection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-93921

Affected Vendors & Products

Vendor	Product	Version / Range
siyuan	si_yuan	to 3.8.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

SiYuan versions up to 3.8.4 have a flaw where the getDynamicIcon endpoint does not enforce publish access control. This allows users with read-only tokens to access metadata of restricted documents by exploiting template injection with type=8. Attackers can retrieve block titles, names, aliases, and hierarchical paths of documents they should not be able to see.

Impact Analysis

If you use SiYuan with sensitive documents, attackers could access restricted metadata without proper authorization. This could lead to unauthorized information exposure, potential data leaks, or further exploitation if combined with other vulnerabilities.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data protection, such as GDPR's principle of least privilege or HIPAA's safeguards for protected health information. Unauthorized access to document metadata may result in regulatory penalties or legal consequences.

Mitigation Strategies

Upgrade SiYuan to a version beyond 3.8.4 where the access control issue in the getDynamicIcon endpoint is fixed.

Hi! I’m here to help you understand CVE-2026-93921. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70