THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-pm3w-vxp9-ccwc (medium) — SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered

[GHSA] GHSA-pm3w-vxp9-ccwc (medium) — SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered

highgithub_advisoriesPublished 2026-09-03

GHSA-pm3w-vxp9-ccwc Severity: medium CVE: CVE-2026-68585

SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered

**CVE:** This vulnerability corresponds to CVE-2026-68585.

### Summary

The `/api/block/getBlockInfo` endpoint r

Indicators of compromise

CVE-2026-68585cve
http://127.0.0.1:6806/api/filetree/setPublishAccessurl
http://127.0.0.1:6808/api/block/getBlockInfourl

Original source: https://github.com/advisories/GHSA-pm3w-vxp9-ccwc