CVE-2026-62204: Arbitrary Bazaar Package Overwrite in SiYuan via Parameter Mismatch

Vulnerability ID: CVE-2026-62204

CVSS Score: 6.6

Published: 2026-10-23

An insufficient verification of data authenticity vulnerability in SiYuan prior to version 3.7.4 allows an attacker to overwrite arbitrary installed marketplace packages (plugins, widgets, themes, and templates). By providing a mismatched package name and package archive repository URL during a Bazaar installation request, arbitrary file write into trusted plugin directories can be achieved, enabling persistence and execution across application restarts.

TL;DR

Decoupled parameter handling in SiYuan's Bazaar installer allowed package archives to overwrite arbitrary installed plugins without validating package manifest consistency.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-345

Attack Vector : Local / API Request

CVSS v3.1 Score : 6.6 (Medium)

CVSS v4.0 Score : 5.9 (Medium)

EPSS Score : 0.00094 (0.56th percentile)

Exploit Status :…