SiYuan tiene una SSRF de Lectura Completa a través de /api/network/forwardProxy en github.com/siyuan-note/siyuan/kernel

The SSRF vulnerability in SiYuan Kernel allows an attacker to craft malicious requests through the /api/network/forwardProxy endpoint. This can lead to unauthorized access to internal services and resources that are not directly exposed to the internet. An attacker could potentially read sensitive data stored within the SiYuan application or even interact with other internal systems. The full-read nature of the SSRF means the attacker isn't limited to specific protocols or ports, significantly expanding the potential attack surface. While no immediate data exfiltration is guaranteed, successful exploitation could provide valuable reconnaissance information for further attacks.

Organizations using SiYuan for note-taking, particularly those with internal services or resources that are not directly exposed to the internet, are at risk. Environments with legacy SiYuan installations or those that have not implemented robust network segmentation are especially vulnerable.

• linux / server: Monitor SiYuan application logs for unusual outbound network connections originating from the /api/network/forwardProxy endpoint. Use journalctl -u siyuan to filter for relevant log entries.

journalctl -u siyuan | grep '/api/network/forwardProxy'

• generic web: Use curl to test the /api/network/forwardProxy endpoint with various internal and external URLs to identify potential SSRF behavior.

curl -v 'http://localhost:10000/api/network/forwardProxy?url=http://169.254.169.254/latest/meta-data/'

1. 2026-03-12Disclosure

   disclosure

1. Reservado2026-03-10
2. Publicada2026-03-12
3. Modificada2026-03-23
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2026-32110 is to upgrade SiYuan Kernel to version 3.6.0 or later. If upgrading immediately is not feasible, consider implementing temporary workarounds such as restricting outbound network access from the SiYuan server using a firewall or proxy. Carefully review and restrict the allowed domains or IP addresses that the /api/network/forwardProxy endpoint can access. Implementing a Web Application Firewall (WAF) with SSRF protection rules can also help to block malicious requests. Monitor application logs for suspicious outbound requests originating from the /api/network/forwardProxy endpoint.