PT-2026-88945
CVE-2026-87807
·
Published
2026-09-09
·
Updated
2026-09-10
Description by
CVSS 4.0
8.7
HighMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
siyuan versions prior to 3.8.2
Description
An authenticated SQL injection exists in the 'fullTextSearchBlock' endpoint via the
method query parameter. This allows attackers to use UNION SELECT statements to read the entire blocks table, which bypasses publish-access controls and exposes sensitive attributes and all document content.Recommendations
Update to version 3.8.2 or later.
Avoid using the
method parameter in the 'fullTextSearchBlock' endpoint until the update is applied.Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾