GHSA-xp3q-r38w-vgqm: SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized

Three routes, /api/storage/getLocalStorage, getLocalStorageVal and getLocalStorageVals, are registered with CheckAuth only and are reachable by the publish RoleReader token and anonymously when Publish.Auth.Enable is false. All three call model.GetLocalStorage() and then, for read-only roles, FilterLocalStorageByPublishAccess.

That filter begins by assigning the administrator’s entire storage map to its return value and then removes three specific fields. Everything else in the map is returned unmodified. A single unauthenticated POST with an empty body returns the administrator’s recently closed tabs with their document titles and identifiers, their current search keywords and the paths those searches cover, the expanded private paths in their file tree, and per-document identifiers from several other keys.