CVE-2026-54068 Details
Description
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the /api/icon/getDynamicIcon endpoint is explicitly excluded from authentication in SiYuan's kernel router (router.go, "不需要鉴权" -- no auth needed). When called with type=8 and a valid block id parameter, this endpoint invokes RenderDynamicIconContentTemplate, which executes a Go template that includes the querySQL and queryBlocks functions. These functions run arbitrary SELECT statements against the SiYuan SQLite database. An unauthenticated network-adjacent attacker who knows a valid block ID can exfiltrate all user note content, tags, asset references, and block attributes from the database. This vulnerability is fixed in 3.7.0.
A vulnerability in SiYuan, an open-source personal knowledge management system, allows for unauthenticated exfiltration of SQLite database content. This issue affects versions prior to 3.7.0. The vulnerability arises in the '/api/icon/getDynamicIcon' endpoint, which is not protected by authentication. When the endpoint is accessed with a specific type and a valid block ID, it executes a Go template that includes functions capable of running arbitrary SQL SELECT statements against the SiYuan SQLite database. An attacker with knowledge of a valid block ID can retrieve all user note content, tags, asset references, and block attributes from the database.
Users can upgrade to SiYuan version 3.7.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gcm7-57gf-953c | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gcm7-57gf-953c | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SiYuan | v3.6.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |