https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 15:50:02 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352694 EUVD-2026-352694 https://cve.radiocsirt.org/vuln/euvd-2026-352694 https://cve.radiocsirt.org/vuln/fkie_cve-2026-69085 <p>SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.</p> <p>SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-69085 https://cve.radiocsirt.org/vuln/ghsa-33jq-p8c2-q3q4 <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>### Summary</p> <p>The `/api/filetree/searchDocs` endpoint concatenates the caller-supplied search keyword directly into a SQL statement with no escaping and no parameter binding. The endpoint is gated by `CheckAuth` only reachable by the publish RoleReader token, and by the anonymous account when `Publish.Auth.Enable` is `false`. The resulting statement runs on a read-write SQLite handle through a driver that executes stacked (`;`-separated) statements, against the global `blocks` table spanning all cleartext notebooks. An unauthenticated request can therefore read and write database content across every non-encrypted notebook on the instance.</p> <p>### Details</p> <p>Data flow, unescaped and unbound at every hop:</p> <p>- `searchDocs` (`kernel/api/filetree.go`): `k := arg[&#34;k&#34;].(string)` passed straight to `model.SearchDocs(k, …)`, no sanitization. - `SearchDocs` (`kernel/model/file.go`): after `TrimSpace` and `strings.Fields`, each token is spliced into a single-quoted `LIKE` literal by concatenation `condition.WriteString(&#34;(hpath LIKE &#39;%&#34; + k + &#34;%&#39;&#34;)`. No escaping, no `&#39;&#39;` doubling, no bind placeholder. - `NAMFilter` (`kernel/conf/search.go`): appends `&#34; OR name LIKE &#39;%&#34; + keyword + &#34;%&#39;&#34;` (and `alias`, `memo`) the same way, enabled by default. - `QueryRootBlockByCondition` (`kernel/sql/block_query.go`): `&#34;SELECT *, … FROM blocks WHERE type = &#39;d&#39; AND &#34; + condition + &#34; ORDER BY … LIMIT …&#34;` passed to `query(sqlStmt)`.</p> <p>The only value-inspecting guard is `ast.IsNodeIDPattern(keyword)`, which merely…</p> <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>### Summary</p> <p>The `/api/filetree/searchDocs` endpoint concatenates the caller-supplied search keyword directly into a SQL statement with no escaping and no parameter binding. The endpoint is gated by `CheckAuth` only reachable by the publish RoleReader token, and by the anonymous account when `Publish.Auth.Enable` is `false`. The resulting statement runs on a read-write SQLite handle through a driver that executes stacked (`;`-separated) statements, against the global `blocks` table spanning all cleartext notebooks. An unauthenticated request can therefore read and write database content across every non-encrypted notebook on the instance.</p> <p>### Details</p> <p>Data flow, unescaped and unbound at every hop:</p> <p>- `searchDocs` (`kernel/api/filetree.go`): `k := arg[&#34;k&#34;].(string)` passed straight to `model.SearchDocs(k, …)`, no sanitization. - `SearchDocs` (`kernel/model/file.go`): after `TrimSpace` and `strings.Fields`, each token is spliced into a single-quoted `LIKE` literal by concatenation `condition.WriteString(&#34;(hpath LIKE &#39;%&#34; + k + &#34;%&#39;&#34;)`. No escaping, no `&#39;&#39;` doubling, no bind placeholder. - `NAMFilter` (`kernel/conf/search.go`): appends `&#34; OR name LIKE &#39;%&#34; + keyword + &#34;%&#39;&#34;` (and `alias`, `memo`) the same way, enabled by default. - `QueryRootBlockByCondition` (`kernel/sql/block_query.go`): `&#34;SELECT *, … FROM blocks WHERE type = &#39;d&#39; AND &#34; + condition + &#34; ORDER BY … LIMIT …&#34;` passed to `query(sqlStmt)`.</p> <p>The only value-inspecting guard is `ast.IsNodeIDPattern(keyword)`, which merely…</p> https://cve.radiocsirt.org/vuln/ghsa-33jq-p8c2-q3q4