CVE-2026-59834: SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content

Siyuan’s block search endpoint concatenates attacker-controlled paths[] values into SQL predicates used by non-SQL search modes. Through Siyuan’s publish service, an unauthenticated visitor is forwarded to the kernel with a reader-role token and can reach POST /api/search/fullTextSearchBlock.

An attacker can inject a UNION SELECT through paths[] and return rows from hidden documents while projecting an allowed visible box and path. The post-query publish access filter trusts the projected box and path, so the injected hidden row is returned to the publish visitor.