CVE-2026-59834 Details

A SQL injection vulnerability has been identified in SiYuan, an open-source personal knowledge management system, prior to version 3.7.1. The issue arises in the block search endpoint, specifically the POST /api/search/fullTextSearchBlock route. The vulnerability allows an unauthenticated publish visitor to inject a UNION SELECT statement through attacker-controlled paths, bypassing visibility controls and accessing content from hidden documents. This is achieved by exploiting the endpoint's handling of SQL predicates in non-SQL search modes, concatenating injected values without proper validation or escaping.

Users are advised to update to SiYuan version 3.7.1 or later, where this vulnerability has been fixed. Additionally, ensure that SQL query construction validates and sanitizes user inputs, particularly for paths and notebook IDs, to prevent injection attacks.