CVE-2026-32110
Last modified
CVE-2026-32110 is a high-severity vulnerability rated 8.3/10 on the CVSS scale. SiYuan is a personal knowledge management system. Prior to 3.6.0, the /api/network/forwardProxy endpoint allows authenticated users to make arbitrary HTTP requests from the server. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
SiYuan is a personal knowledge management system. Prior to 3.6.0, the /api/network/forwardProxy endpoint allows authenticated users to make arbitrary HTTP requests from the server. The endpoint accepts a user-controlled URL and makes HTTP requests to it, returning the full response body and headers. There is no URL validation to prevent requests to internal networks, localhost, or cloud metadata services. This vulnerability is fixed in 3.6.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| B3log | Siyuan | < 3.6.0 |
References
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-56cv-c5p2-j2wgExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-32110?
How severe is CVE-2026-32110?
How do I fix CVE-2026-32110?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-32105xrdp is an open source RDP server. In versions through 0.10.…7.7
- CVE-2026-32106StudioCMS is a server-side-rendered, Astro native, headless …7.2
- CVE-2026-32107xrdp is an open source RDP server. In versions through 0.10.…8.8
- CVE-2026-32108Copyparty is a portable file server. Prior to 1.20.12, there…6.5
- CVE-2026-32109Copyparty is a portable file server. Prior to 1.20.12, if an…4.4
- CVE-2026-3211Cross-Site Request Forgery (CSRF) vulnerability in Drupal Th…4.3
- CVE-2026-32111ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the h…5.3
- CVE-2026-32112ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the h…4.7
- CVE-2026-32113Discourse is an open-source discussion platform. From versio…6.1
- CVE-2026-32114Discourse is an open-source discussion platform. Prior to ve…4.3
- CVE-2026-32116Magic Wormhole makes it possible to get arbitrary-sized file…8.1
- CVE-2026-32117The grafanacubism-panel plugin allows use of cubism.js in Gr…5.4
Are you affected by CVE-2026-32110?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST