SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.
Summary
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates attacker-controlled paths values into SQL predicates used by non-SQL search modes, allowing an unauthenticated publish visitor to inject a UNION SELECT and return rows from hidden documents by projecting an allowed visible box and path. This issue is fixed in versions 3.7.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| siyuan-note | siyuan | before 3.7.1 | 3.7.1 | Patch available | CNA |
| — | github.com/siyuan-note/siyuan/kernel (Go) | before 0.0.0-20260704035518-d0f0fe146fb0 | 0.0.0-20260704035518-d0f0fe146fb0 | Patch available | GHSA-h89q-4j2h-7h88 |
- siyuan Vendorsiyuan-note Affected before 3.7.1 Fixed in 3.7.1 Patch available CNA
- github.com/siyuan-note/siyuan/kernel (Go) Vendor— Affected before 0.0.0-20260704035518-d0f0fe146fb0 Fixed in 0.0.0-20260704035518-d0f0fe146fb0 Patch available GHSA-h89q-4j2h-7h88
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:* | — | — | siyuan-note |
- cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:* Versions — — ·siyuan-note
Remediation
- Fix · CNA siyuan (siyuan-note) Fixed in 3.7.1
- Fix · GHSA-h89q-4j2h-7h88 github.com/siyuan-note/siyuan/kernel (Go) Fixed in 0.0.0-20260704035518-d0f0fe146fb0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-59834
- 2026-10-03 Alias added: GHSA-h89q-4j2h-7h88
References
Other 5
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h89q-4j2h-7h88
- https://github.com/siyuan-note/siyuan/commit/57bcad4b331836880bfe6be25d4180bdcf10db0d
- https://github.com/siyuan-note/siyuan/commit/d0f0fe146fb07d594fcadc4f48d4f7c30ac01d1e
- https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1
- https://github.com/siyuan-note/siyuan
More siyuan-note vulnerabilities
- TI-2026-48492 SiYuan before v3.7.3 SQL Injection via searchDocs CVSS 4.0CRITICAL 9.9
- TI-2026-48491 SiYuan before v3.7.3 SQL Injection via searchEmbedBlock CVSS 4.0CRITICAL 9.9
- TI-2026-48490 SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent CVSS 4.0CRITICAL 9.9
- TI-2026-47010 SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP CVSS 4.0CRITICAL 10.0
- TI-2026-26050 SiYuan has directory traversal within its publishing service CVSS 3.1CRITICAL 9.8
- TI-2026-25256 SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-59834 · CVE Program
- CVE-2026-59834 · NVD
- FIRST EPSS
- GHSA-h89q-4j2h-7h88 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences