CVE-2026-59834CWE-89

SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content

High · published July 9, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
42.5
In the wild
Unconfirmed
What it is

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates attacker-controlled paths values into SQL predicates used by non-SQL search modes, allowing an unauthenticated publish visitor to inject a UNION SELECT and return rows from hidden documents by projecting an allowed visible box and path. This issue is fixed in versions 3.7.1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00508 · 42.5th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-07-09T22:15Z
EPSS history
Timeline
  • 09 JUL 22:15Z
    SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content
    cvelistv5