CVE-2026-87807: siyuan before v3.8.2 SQL Injection via fullTextSearchBlock
siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers can inject UNION SELECT statements to read the entire blocks table, bypassing publish-access controls and exposing all document content and sensitive attributes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
siyuanto a version that resolves this vulnerability.Fixed in v3.8.2 - Compensating control
Temporarily restrict network access (e.g., via firewall/WAF/ACL) to the fullTextSearchBlock endpoint method=1 until upgrading to v3.8.2.
Event History
Frequently Asked Questions
Does exploitation require an authenticated account?
Yes. The vulnerability description identifies this as an authenticated SQL injection issue, despite the listed vector showing PR:N.
What information could be exposed if the issue is exploited?
An attacker can use UNION SELECT injection to read the entire blocks table. This can expose all document content and sensitive attributes.
Are publish-access controls sufficient to protect affected content?
No. Successful exploitation bypasses publish-access controls when reading data from the blocks table.
Which SiYuan versions are affected?
SiYuan versions before v3.8.2 are affected. Updating to v3.8.2 or later addresses the affected version range identified in the data.