GitHub Security Advisory (GHSA-h6w7-xxcf-w2mq)Vendor advisory
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h6w7-xxcf-w2mq CVE-2026-72795
CRITICAL
SiYuan before v3.7.4 Information Disclosure via Embed Block
Record summary
CVE-2026-72795 has a selected CVSS score of 9.2 (critical).
Description
SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints. Attackers can request published blocks containing embed queries to read content from password-protected, hidden, or forbidden documents without authorization.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 12, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Default status: unaffected | CVE List | Before 3.7.4 | affected |
| 3.7.4 | unaffected |
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-72795 VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via Embed BlockThird-party advisory
https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-embed-block