CVE-2026-74905 PUBLISHED

SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass

Assigner: VulnCheck
Reserved: 17.08.2026 Published: 18.08.2026 Updated: 18.08.2026

SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does not recognize IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001::/32) that embed private IPv4 destinations. When SafeMode is enabled, an authenticated attacker can bypass the SSRF guard via the network forward proxy, WebSocket proxy, or SSE proxy endpoints by supplying a URL whose hostname resolves to such a transition address, reaching internal services and cloud metadata endpoints (e.g., 169.254.169.254). Because the forward proxy returns the full response body, this is a full-read SSRF that can be used to steal instance credentials, reach internal services, and port-scan internal infrastructure.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
CVSS Score: 6.9

Product Status

Vendor siyuan-note
Product siyuan
Versions Default: unaffected
  • affected from 0 to 3.7.4 (excl.)
  • Version 3.7.4 is unaffected

References

Problem Types

  • Server-Side Request Forgery (SSRF) CWE