CVE-2026-62204: Arbitrary Bazaar Package Overwrite in SiYuan via Parameter Mismatch

Vulnerability ID: CVE-2026-62204
CVSS Score: 6.6
Published: 2026-10-23

An insufficient verification of data authenticity vulnerability in SiYuan prior to version 3.7.4 allows an attacker to overwrite arbitrary installed marketplace packages (plugins, widgets, themes, and templates). By providing a mismatched package name and package archive repository URL during a Bazaar installation request, arbitrary file write into trusted plugin directories can be achieved, enabling persistence and execution across application restarts.

TL;DR

Decoupled parameter handling in SiYuan's Bazaar installer allowed package archives to overwrite arbitrary installed plugins without validating package manifest consistency.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-345
• Attack Vector: Local / API Request
• CVSS v3.1 Score: 6.6 (Medium)
• CVSS v4.0 Score: 5.9 (Medium)
• EPSS Score: 0.00094 (0.56th percentile)
• Exploit Status: Proof of Concept / Advisory Stage
• CISA KEV Status: Not Listed

Affected Systems

• SiYuan personal knowledge management system (versions prior to v3.7.4)

Mitigation Strategies

• Upgrade SiYuan instance to version v3.7.4 or later.
• Restrict local API access to trusted same-origin environments.
• Audit installed Bazaar packages in the workspace data directory for unexpected file changes.

Remediation Steps:

1. Download and apply SiYuan release v3.7.4 or v3.8.0+.
2. Restart the SiYuan application kernel to apply updated binary logic.
3. Verify that plugin installation logic rejects installation requests when package manifest names mismatch client parameters.

References

• GitHub Security Advisory GHSA-rpx2-p6hp-x5gj
• SiYuan Commit 26ccb40d390eb7d9b04673629a58ab1d69cc7e53
• VulnCheck Advisory for CVE-2026-62204
• SiYuan Release v3.8.0 Tag
• CVE-2026-62204 Record

Read the full report for CVE-2026-62204 on our website for more details including interactive diagrams and full exploit analysis.