PT-2026-25387 · Siyuan · Siyuan
Fg0X0
·
Published
2026-03-13
·
Updated
2026-03-30
·
CVE-2026-32704
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
SiYuan versions prior to 3.6.1
Description
SiYuan is a personal knowledge management system. The
POST /api/template/renderSprig endpoint lacks a proper authorization check (model.CheckAdminRole), allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database. This can lead to the exfiltration of all note content, metadata, and custom attributes. The vulnerable component calls model.RenderGoTemplate, which registers SQL functions that can be executed without role verification. An attacker can leverage this to dump all note content, document hierarchy, tags, custom attributes, block IDs, and timestamps. This is particularly concerning in shared or enterprise environments where lower-privilege accounts should not have access to other users' notes. The vulnerable function is renderSprig. The vulnerable parameter is the template parameter in the POST request to the /api/template/renderSprig endpoint.Recommendations
Upgrade to SiYuan version 3.6.1 or later to resolve this issue.
Exploit
Fix
Incorrect Permission
Improper Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Siyuan