{"cve":"CVE-2026-101092","nvd":{"published":"2026-09-28T22:17:30.603","modified":"2026-10-01T16:17:30.753","status":"Deferred","description":"SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to leak detached-row image asset paths and filenames that the rendering endpoint would deny.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-200"],"references":["https://github.com/siyuan-note/siyuan/commit/48229dc76ce4212fe42295393af617947b157c15","https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j9p6-5639-gf4f","https://www.vulncheck.com/advisories/siyuan-before-3.8.4-information-disclosure-via-getcurrentattrviewimages","https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j9p6-5639-gf4f"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:48.555445741+00:00"},"epss":{"cve":"CVE-2026-101092","score":0.00297,"percentile":0.2216,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}