Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates attacker-controlled paths values into SQL predicates used by non-SQL search modes, allowing an unauthenticated publish visitor to inject a UNION SELECT and return rows from hidden documents by projecting an allowed visible box and path. This issue is fixed in versions 3.7.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-10 | 3 | Disclosure1General1Patch1 |
| 2026-09-02 | 1 | General1 |
🔴 SiYuan (siyuan-note), SQL Injection, #CVE-2026-59834 (High) -DC-Sep2026-2086 https://dailycve.com/siyuan-siyuan-note-sql-injection-cve-2026-59834-high-dc-sep2026-2086/
Post summary
A brief alert announcing a high‑severity SQL Injection vulnerability (CVE‑2026‑59834) in SiYuan, with no specific PoC, exploit, or mitigation details provided.
🚨*CVE* CVE-2026-59834 SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates attacker-co… https://www.cve.org/CVERecord?id=CVE-2026-59834 ----- Traducción: CVE-2026-59834 SiY… http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑59834 in SiYuan, highlighting a flaw in the full-text search endpoint present before version 3.7.1, but it does not provide a PoC, exploit, patch, or evidence of active exploitation.
CVE-2026-59834 SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates attacker-co… https://www.cve.org/CVERecord?id=CVE-2026-59834
Post summary
The text briefly notes CVE‑2026‑59834 in SiYuan, referencing an endpoint that performs concatenation before version 3.7.1, but contains no further details about the vulnerability, exploitation, or remediation.
#CVE-2026-59834 - #SQLi in #Siyuan's block search endpoint. Unauthenticated #UNION SELECT injection exposes hidden docs. #CVSS 7.5. Update to 3.7.1 immediately. https://www.valtersit.com/cve/CVE-2026-59834/ #CVEAlert #infosec #SiYuan #devsecops #devops #developers #sysadmin #cybernews #redteam #blueteam
Post summary
Siyuan’s block search endpoint is vulnerable to unauthenticated SQL injection, exposing hidden documents; a CVSS score of 7.5 is assigned, and users are urged to update to version 3.7.1 immediately.