CVE-2026-59834: SiYuan SQL Injection in Search Endpoint (v3.7.0 and Earlier)

Technical summary

CVE-2026-59834 is a SQL injection vulnerability in SiYuan's fullTextSearchBlock search endpoint (POST /api/search/fullTextSearchBlock). The endpoint concatenates unsanitized, user-controlled path values directly into SQL predicates used by the non-SQL search engine. This allows an unauthenticated attacker to inject UNION SELECT statements and extract rows from restricted documents. The attack works by projecting allowed visible content (a legitimate box and path) alongside injected queries, enabling data exfiltration from documents the attacker should not access. The vulnerability affects versions prior to 3.7.1 and is resolved in that release.

Business impact

This vulnerability poses a direct confidentiality risk to any organization or individual using SiYuan for sensitive knowledge management. Private notes, research, planning documents, and other confidential information stored in restricted document collections can be accessed by unauthenticated attackers. For enterprises using SiYuan to manage proprietary information, competitive intelligence, or employee records, this represents a material data breach risk. The lack of authentication requirement significantly lowers the barrier to exploitation—any internet-connected instance is at risk without additional network controls. Reputational and compliance implications depend on the sensitivity and scope of exposed content.

Affected systems

SiYuan versions prior to 3.7.1 are affected. The vulnerability is present in the search API endpoint and impacts all deployments accessible over the network that have not been upgraded to 3.7.1 or later. Publicly exposed SiYuan instances are at highest risk, but even internal deployments are vulnerable to compromise by network-adjacent or insider threat actors.

Exploitability

This vulnerability has a high exploitability score (CVSS 7.5 with no authentication or user interaction required, network-accessible). An attacker needs only to craft a malicious HTTP POST request to the search endpoint with a specially formatted path parameter. No authentication, no user interaction, and no special configuration are required—any accessible instance can be targeted. The attack is straightforward to execute once the endpoint and injection point are identified, making it likely that generic scanning and exploitation will occur if the vulnerability becomes widely known.

Remediation

Upgrade SiYuan to version 3.7.1 or later immediately. This version includes input validation and parameterization fixes that prevent the path injection attack. Organizations should verify upgrade completion and confirm that the application is running a patched version before considering the issue resolved. For environments where immediate patching is not possible, restrict network access to SiYuan instances using firewalls, VPNs, or reverse proxies, and disable the fullTextSearchBlock endpoint if it is not required for operations.

Patch guidance

Apply the upgrade to SiYuan version 3.7.1 or later as a priority patch. Verify the upgrade by confirming the version number in the application settings or admin panel. Test search functionality in non-production environments first to ensure compatibility with existing document structures and custom configurations. Once patched in production, monitor logs for any evidence of prior exploitation attempts (review POST requests to /api/search/fullTextSearchBlock with suspicious path parameters). No rollback considerations are known; the patch is a straightforward bug fix.

Detection guidance

Monitor HTTP access logs for POST requests to /api/search/fullTextSearchBlock with unusual or encoded characters in the path parameter, particularly UNION, SELECT, or other SQL keywords. Implement Web Application Firewall rules to block requests containing SQL injection patterns in search parameters. Review SiYuan audit logs (if available) for search queries executed by unauthenticated sessions targeting documents outside the expected search scope. Network-based detection should flag repeated failed or successful search queries from external sources to internal SiYuan instances.

Why prioritize this

This vulnerability merits immediate patching due to the combination of high CVSS score (7.5), complete lack of authentication requirement, and confidentiality impact on sensitive user data. The attack surface is broad (any network-accessible SiYuan instance) and the barrier to exploitation is low. The fact that this is a direct data exfiltration vector—not a denial-of-service or limited-impact bug—makes it a priority for any organization relying on SiYuan for document storage or knowledge management.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects high confidentiality impact, network accessibility, no required authentication or user interaction, and low attack complexity. The score does not account for organizational context (e.g., whether the affected instance holds sensitive data or is internet-facing), so risk assessment should incorporate those factors locally. Organizations with confidential information in SiYuan should treat this as a critical vulnerability despite the 7.5 base score.

Frequently asked questions