Beveiligingsadvies

CVE-2026-59834

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-07-09 22:15:48

Laatst bijgewerkt 2026-07-10 13:33:27

Toegewezen door GitHub_M

CVSS-score 7.5

Status PUBLISHED

Beschrijving

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates attacker-controlled paths values into SQL predicates used by non-SQL search modes, allowing an unauthenticated publish visitor to inject a UNION SELECT and return rows from hidden documents by projecting an allowed visible box and path. This issue is fixed in versions 3.7.1.

← Alle CVE's bekijken Bekijk op cve.org ↗