PT-2026-24836 · Siyuan · Siyuan
Neo-Ai-Engineer
+1
·
Published
2026-03-11
·
Updated
2026-03-25
·
CVE-2026-32110
CVSS v3.1
8.3
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
SiYuan versions prior to 3.6.0
Description
SiYuan is a personal knowledge management system. The
/api/network/forwardProxy endpoint allows authenticated users to make arbitrary HTTP requests from the server. The endpoint accepts a user-controlled URL and makes HTTP requests to it, returning the full response body and headers. There is no URL validation to prevent requests to internal networks, localhost, or cloud metadata services. This could allow attackers to perform internal network reconnaissance, potentially steal cloud credentials, exfiltrate data, or bypass firewalls. The vulnerable code resides in /kernel/api/network.go (Lines 153-317) within the forwardProxy function, which only validates the URL format and not the destination. The url parameter within the JSON payload sent to the /api/network/forwardProxy endpoint is user-controlled.Recommendations
Update SiYuan to version 3.6.0 or later.
Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Siyuan