CVE-2026-74902 — SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAd…
Published: 2026-08-18 · CVSS: 9.3 · CVSS 4.0
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access when a user drags, drops, or pastes the file into the editor.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7