CVE-2026-59853: SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search criteria from data/storage/criteria.json w

mediumCVSS 6.5CVE-2026-59853

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search criteria from data/storage/criteria.json without the publish-access filtering used by sibling storage endpoints, allowing a publish-mode Reader to read private document paths, notebook, document, and block IDs, and search and replace keywords for unpublished documents. This issue is fixed in versions 3.7.1.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 6.5
Published: 2026-07-09
Last updated: 2026-07-10
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-59853

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-598530.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 14% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-59853	coverage & exploitation status	NVD · CVE.org

Recent advisories for SiYuan is an

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

criticalGHSA-56mp-4f3v-fgj2: SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Contentghsa · 2026-07-10
criticalGHSA-5xfx-xj4h-5p7r: SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()ghsa · 2026-07-10
highGHSA-w7cg-whh7-xp28: SiYuan: Stored XSS in Bazaar marketplace via package README event handlersghsa · 2026-07-10
criticalGHSA-hvr9-72v2-fff3: SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlistghsa · 2026-07-10
mediumGHSA-gcm7-57gf-953c: SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getD…ghsa · 2026-07-10
criticalGHSA-mvjr-vv3c-w4qv: SiYuan: Stored XSS to RCE via CSS-snippet breakout in renderSnippet()ghsa · 2026-07-10

CVE-2026-59853: SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search criteria from data/storage/criteria.json w

Details

Exploitation outlook

Referenced CVEs

Recent advisories for SiYuan is an

More from NVD Recent CVEs