Medium severity5.8NVD Advisory· Published Aug 13, 2026· Updated Aug 26, 2026

CVE-2026-73610

Description

SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document identifiers, and expanded folder paths by calling the getLocalStorage endpoint.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Siyuan Note/Siyuanllm-fuzzy
Range: <3.7.4

Patches

Vulnerability mechanics

References

github.com/siyuan-note/siyuan/security/advisories/GHSA-xp3q-r38w-vgqmnvd
www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-local-storagenvd

News mentions

Siyuan Note: 25 Vulnerabilities Including RCE and Auth Bypass Disclosed Together
Vypr Intelligence · Aug 15, 2026

cvss	0.377
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000