CVE-2026-126266: SiYuan from 3.6.0 before 3.8.9 Publish-Password Bypass via getDoc Regex Keywords
SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod 3 and a broad regex to read protected body text returned in the unfiltered keywords field.
Event History
Frequently Asked Questions
Which deployments are exposed?
SiYuan versions from 3.6.0 before 3.8.9 are affected when unauthenticated visitors can access published content. The issue concerns documents protected with per-document publish passwords.
What does an attacker need to exploit this issue?
No authentication or user interaction is required. An attacker can send a POST request to /api/filetree/getDoc using queryMethod 3 and a broad regular-expression query.
What information can be disclosed?
The vulnerable request can return protected document body text through the unfiltered keywords field, bypassing the document's publish-password protection.
How can I tell whether a system is vulnerable?
Check whether the SiYuan version is from 3.6.0 through versions before 3.8.9 and whether published documents use per-document passwords. A vulnerable endpoint is /api/filetree/getDoc when queried with queryMethod 3.