Vulnerability Description
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7h8j-qw37-w46g
- https://www.vulncheck.com/advisories/siyuan-before-3.8.2-stored-xss-via-incomple
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7h8j-qw37-w46g
FAQ
What is CVE-2026-84803?
CVE-2026-84803 is a vulnerability with a CVSS score of 9.0 (CRITICAL). SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files wi...
How severe is CVE-2026-84803?
CVE-2026-84803 has been rated CRITICAL with a CVSS base score of 9.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-84803?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.