Executive brief
SiYuan is a popular open-source note-taking and knowledge management application. Its publish service allows unauthenticated visitors to search published documents, but a SQL injection vulnerability in the block search endpoint enables attackers to read hidden private notes. By injecting crafted SQL through the search filter, an attacker can extract confidential content that should remain invisible to published visitors, completely bypassing SiYuan's access controls.
Technical details
The vulnerability is a SQL injection (CWE-89) in SiYuan's `POST /api/search/fullTextSearchBlock` endpoint. The attacker-controlled `paths[]` parameter is parsed and directly concatenated into SQL WHERE clauses without escaping or parameterization. Specifically, notebook IDs and file paths are inserted via string formatting into queries like `box = '%s'` and `path LIKE '%s%%'`. An unauthenticated attacker reaching the endpoint through the publish service (which forwards requests with reader-role credentials) can inject a `UNION SELECT` statement to retrieve rows from hidden documents. The post-query publish access filter trusts the returned row's `box` and `path` fields without verifying the actual query result origin, allowing the attacker to project visible document paths while returning hidden document content. The vulnerability requires the publish service to be enabled and at least one visible document to exist; the attacker needs network access to the publish endpoint. A fix using parameterized queries and pre-execution access validation was released in version 0.0.0-20260704035518-d0f0fe146fb0.
Affected products
- SiYuan SiYuan < 0.0.0-20260704035518-d0f0fe146fb0 (prior to v3.7.1)
Timeline
- 2026-07-02: disclosed: Published in GitHub Advisory Database
- 2026-07-04: patched: Fix released in version 0.0.0-20260704035518-d0f0fe146fb0 / v3.7.1
References
- https://api.github.com/users/mountainousmolehill
- https://github.com/mountainousmolehill
- https://api.github.com/users/mountainousmolehill/gists%7B/gist_id%7D
- https://api.github.com/users/mountainousmolehill/repos
- https://avatars.githubusercontent.com/u/258987900?v=4
- https://api.github.com/users/mountainousmolehill/events%7B/privacy%7D