CVE-2026-73610: SiYuan before v3.7.4 Information Disclosure via Local Storage

Q: What is the severity of CVE-2026-73610?

CVE-2026-73610 has a medium severity rating of 5.8.

Q: How do I fix CVE-2026-73610?

To fix CVE-2026-73610, update SiYuan to version 3.7.4 or later.

Q: What kind of vulnerability is CVE-2026-73610?

CVE-2026-73610 is an information disclosure vulnerability affecting local storage in SiYuan.

Q: Who is affected by CVE-2026-73610?

CVE-2026-73610 affects administrators, as well as unauthenticated attackers and publish readers.

Q: What information can be accessed due to CVE-2026-73610?

CVE-2026-73610 allows access to closed-tab history, search keywords, and private document identifiers.

Published Aug 13, 2026

Updated

SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document identifiers, and expanded folder paths by calling the getLocalStorage endpoint.

Affected Software

1 affected component

SiYuan<3.7.4

Event History

Aug 13, 2026

CVE Published

via MITRE·11:28 AM

Data Sourced

via MITRE·11:28 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-73610?

CVE-2026-73610 has a medium severity rating of 5.8.

How do I fix CVE-2026-73610?

To fix CVE-2026-73610, update SiYuan to version 3.7.4 or later.

What kind of vulnerability is CVE-2026-73610?

CVE-2026-73610 is an information disclosure vulnerability affecting local storage in SiYuan.

Who is affected by CVE-2026-73610?

CVE-2026-73610 affects administrators, as well as unauthenticated attackers and publish readers.

What information can be accessed due to CVE-2026-73610?