CVE-2026-32110 SiYuan has a Full-Read SSRF via /api/network/forwardProxy

What is CVE-2026-32110?

CVE-2026-32110 is a high-severity server-side request forgery vulnerability in B3log Siyuan, published on 11 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SiYuan is a personal knowledge management system. Prior to 3.6.0, the /api/network/forwardProxy endpoint allows authenticated users to make arbitrary HTTP requests from the server. The endpoint accepts a user-controlled URL and makes HTTP requests to it, returning the full response body and headers. There is no URL validation to prevent requests to internal networks, localhost, or cloud metadata services. This vulnerability is fixed in 3.6.0.

Weakness: CWE-918

Which versions are affected by CVE-2026-32110?

3 open source packages ship an affected version, including github.com/siyuan-note/siyuan/kernel. It affects 1 product.

Products include B3log Siyuan.

How do I fix CVE-2026-32110?

Upgrade github.com/siyuan-note/siyuan/kernel to 3.6.0 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-32110 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32110 exists.

Other vulnerabilities in B3log Siyuan

• CVE-2026-32938 SiYuan has an Arbitrary File Read in its Desktop Publish Service Critical 9.9
• CVE-2026-33669 SiYuan has Arbitrary Document Reading within the Publishing Service Critical 9.8
• CVE-2026-33670 SiYuan has directory traversal within its publishing service Critical 9.8
• CVE-2026-32767 SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API Critical 9.8
• CVE-2024-53504 SQL injection in n/a Critical 9.8

All B3log Siyuan vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-56cv-c5p2-j2wg, GO-2026-4685.