CVE-2026-74902: SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access when a user drags, drops, or pastes the file into the editor.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Users running SiYuan versions earlier than v3.7.4 are affected when they drag, drop, or paste an attacker-controlled file into the editor. Exploitation requires user interaction, but it does not require attacker privileges.
What does an attacker need to do to exploit this issue?
The attacker needs to provide a file whose filename contains a script payload and persuade a user to drag, drop, or paste that file into the editor. The vulnerable upload-validation flow inserts the filename into HTML without escaping it.
What should be done if patching is not immediately possible?
Update SiYuan to v3.7.4 or later. If updating cannot happen immediately, avoid dragging, dropping, or pasting files from untrusted sources into the editor.
How can I determine whether I may already be affected?
Systems are potentially affected if they run a SiYuan version before v3.7.4 and users have handled untrusted files through drag-and-drop or paste operations in the editor. The available information does not provide a definitive indicator of prior exploitation.