EUVD-2026-330202

fkie_cve-2026-54068

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the /api/icon/getDynamicIcon endpoint is explicitly excluded from authentication in SiYuan's kernel router (router.go, "不需要鉴权" -- no auth needed). When called with type=8 and a valid block id parameter, this endpoint invokes RenderDynamicIconContentTemplate, which executes a Go template that includes the querySQL and queryBlocks functions. These functions run arbitrary SELECT statements against the SiYuan SQLite database. An unauthenticated network-adjacent attacker who knows a valid block ID can exfiltrate all user note content, tags, asset references, and block attributes from the database. This vulnerability is fixed in 3.7.0.

GHSA-gcm7-57gf-953c — SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon

Affected: Go: github.com/siyuan-note/siyuan/kernel

### Summary

The `/api/icon/getDynamicIcon` endpoint is explicitly excluded from authentication in SiYuan's kernel router (`router.go`, "不需要鉴权" -- no auth needed). When called with `type=8` and a valid block `id` parameter, this endpoint invokes `RenderDynamicIconContentTemplate`, which executes a Go template that includes the `querySQL` and `queryBlocks` functions. These functions run arbitrary SELECT statements against the SiYuan SQLite database. An unauthenticated network-adjacent attacker who knows a valid block ID can exfiltrate all user note content, tags, asset references, and block attributes from the database.

### Details

**Root cause -- kernel/api/router.go, line 37:**

```go // 不需要鉴权 ginServer.Handle("GET", "/api/icon/getDynamicIcon", getDynamicIcon) ```

**Attack chain:**

1. `getDynamicIcon` (kernel/api/icon.go) checks `type=8` and calls `model.RenderDynamicIconContentTemplate(content, id)` when `content` contains `.action{`.

2. `RenderDynamicIconContentTemplate` (kernel/model/template.go:264) parses `content` as a Go template. The template function map includes `querySQL` and `queryBlocks` registered via `sql.SQLTemplateFuncs`.

3. `querySQL` calls `Query(stmt, 1024)` (kernel/sql/block_query.go) which executes the SQL statement against the SQLite database containing all user notes.

4. The SQL result is rendered into the SVG response body and returned to the unauthenticated caller.

**Constraint:** The block `id` parameter must be a valid block ID that exist…

Most recent entries from all

EUVD-2026-330202

fkie_cve-2026-54068

GHSA-gcm7-57gf-953c — SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon