Is CVE-2026-104410 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104410 being exploited in the wild.

How severe is CVE-2026-104410?

High severity, with a CVSS score of 7.5, published 2 October 2026.

Is there a fix for CVE-2026-104410?

Yes: fixed in v3.8.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104410 attacked?

It is attacked over the network.

Am I affected by CVE-2026-104410?

Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104410: SiYuan information disclosure in export preview API

CVE-2026-104410 · Severity: high · CVSS 7.5 · Published 2026-10-02

SiYuan is a note-taking application that supports publishing documents and embedding database views. An attacker who can access published documents can exploit the /api/export/preview endpoint to read the full contents of database rows from password-protected or unpublished documents, bypassing access controls. This leaks sensitive data such as primary keys and cell values that the document owner intended to keep private.

Technologies: SiYuan. Vendors: SiYuan.

Quick answers

Is CVE-2026-104410 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104410 being exploited in the wild.
How severe is CVE-2026-104410?: High severity, with a CVSS score of 7.5, published 2 October 2026.
Which products and versions are affected?: SiYuan before 3.8.5.
Is there a fix for CVE-2026-104410?: Yes: fixed in v3.8.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104410 attacked?: It is attacked over the network.
Am I affected by CVE-2026-104410?: Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: v3.8.5

Technical details

The /api/export/preview endpoint fails to apply publish-access filtering when serializing database (attribute-view) rows, unlike the parallel renderAttributeView API which correctly filters protected rows. An unauthenticated or publish-reader-authenticated attacker can request an export preview of a public document that embeds a database view aggregating rows from protected documents, causing all row data including protected content to be returned in the response HTML without redaction.

Affected products

SiYuan SiYuan before 3.8.5

Timeline

2026-09-17: disclosed
2026-10-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.