https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 21:43:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352692 EUVD-2026-352692 https://cve.radiocsirt.org/vuln/euvd-2026-352692 https://cve.radiocsirt.org/vuln/fkie_cve-2026-69083 <p>SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.</p> <p>SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-69083 https://cve.radiocsirt.org/vuln/ghsa-fph3-ghq9-vw66 <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>**CVE:** This vulnerability corresponds to [CVE-2026-69083](https://nvd.nist.gov/vuln/detail/CVE-2026-69083).</p> <p>### Summary</p> <p>The `/api/search/fullTextSearchAssetContent` endpoint exposes two SQL flaws on the asset-content database, both reachable by the publish `RoleReader` token and by the anonymous account when `Publish.Auth.Enable` is `false`:</p> <p>1. **method 2** passes a client-supplied SQL statement to the read-write asset-content DB with no single-statement or read-only guard, and without the admin restriction its sibling `fullTextSearchBlock` applies to the same SQL method. 2. **method 3** builds a `REGEXP` clause by concatenating the client expression with no quote-escaping, permitting SQL breakout while the equivalent block-search builder does escape.</p> <p>Both run on a read-write handle through a statement-stacking-capable driver, spanning the cross-notebook asset-content store.</p> <p>### Details</p> <p>**Route / auth tier.** `router.go`: `Handle(&#34;POST&#34;, &#34;/api/search/fullTextSearchAssetContent&#34;, model.CheckAuth, fullTextSearchAssetContent)`, `CheckAuth` only. Anonymous/reader reachable on the publish surface. `parseSearchAssetContentArgs` reads `method` and `query` straight from the JSON body with no constraint, so both are fully client-controlled.</p> <p>**Missing admin guard (contrast with the sibling).** `fullTextSearchBlock` rejects the SQL method for non-admins (`if method == 2 &amp;&amp; !IsAdminRoleContext(c)`). `fullTextSearchAssetContent` has no such check on its handler, so the SQL metho…</p> <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>**CVE:** This vulnerability corresponds to [CVE-2026-69083](https://nvd.nist.gov/vuln/detail/CVE-2026-69083).</p> <p>### Summary</p> <p>The `/api/search/fullTextSearchAssetContent` endpoint exposes two SQL flaws on the asset-content database, both reachable by the publish `RoleReader` token and by the anonymous account when `Publish.Auth.Enable` is `false`:</p> <p>1. **method 2** passes a client-supplied SQL statement to the read-write asset-content DB with no single-statement or read-only guard, and without the admin restriction its sibling `fullTextSearchBlock` applies to the same SQL method. 2. **method 3** builds a `REGEXP` clause by concatenating the client expression with no quote-escaping, permitting SQL breakout while the equivalent block-search builder does escape.</p> <p>Both run on a read-write handle through a statement-stacking-capable driver, spanning the cross-notebook asset-content store.</p> <p>### Details</p> <p>**Route / auth tier.** `router.go`: `Handle(&#34;POST&#34;, &#34;/api/search/fullTextSearchAssetContent&#34;, model.CheckAuth, fullTextSearchAssetContent)`, `CheckAuth` only. Anonymous/reader reachable on the publish surface. `parseSearchAssetContentArgs` reads `method` and `query` straight from the JSON body with no constraint, so both are fully client-controlled.</p> <p>**Missing admin guard (contrast with the sibling).** `fullTextSearchBlock` rejects the SQL method for non-admins (`if method == 2 &amp;&amp; !IsAdminRoleContext(c)`). `fullTextSearchAssetContent` has no such check on its handler, so the SQL metho…</p> https://cve.radiocsirt.org/vuln/ghsa-fph3-ghq9-vw66