CVE-2026-87809: Siyuan before v3.8.2 Information Disclosure via Export Preview
Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpoints. Attackers with reader access can retrieve the full rendered content of private, hidden, or publish-disabled blocks by accessing public documents containing embed queries that select those blocks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Siyuanto a version that resolves this vulnerability.Fixed in v3.8.2 - Compensating control
Restrict access to the public endpoints /api/export/preview and /api/lute/copyStdMarkdown (e.g., via network ACLs/WAF) so that users with reader access cannot reach them while upgrading to v3.8.2.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs reader access and access to a public document containing an embed query that selects private, hidden, or publish-disabled blocks. No user interaction is required.
Which interfaces expose the unfiltered content?
The affected interfaces are /api/export/preview and /api/lute/copyStdMarkdown. They render embedded blocks without applying publish-access filtering.
What should be prioritized for remediation?
Upgrade Siyuan to v3.8.2 or later. Until then, review public documents for embed queries that may select private, hidden, or publish-disabled blocks and restrict reader access where possible.