SiYuan EUVD-2026-42742

Exploitation requires the target to be running SiYuan prior to 3.7.1 with the publish feature enabled and network-reachable by the attacker, since the vulnerable actor is an 'unauthenticated publish visitor' hitting POST /api/search/fullTextSearchBlock. The specific trigger is supplying a malicious paths value that injects a UNION SELECT into the SQL predicates built for the endpoint's non-SQL search modes, spoofing an allowed visible box and path to project hidden-document rows. Limiting factors: the instance must actually expose publish mode publicly (a private, LAN-only, or non-published SiYuan install is not reachable by this actor), and impact is confined to confidentiality - reading hidden documents - with no write or availability effect. No user interaction or authentication is needed once publish mode is exposed.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, base 7.5) indicates a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact but no integrity or availability effect - consistent with a data-disclosure UNION-based SQLi rather than full RCE. The realistic precondition, not captured by the raw vector, is that the target must run SiYuan's publish mode exposed to the attacker; the 'unauthenticated publish visitor' actor means PR:N is justified for reachable instances but the population of publicly published SiYuan servers is a limiting factor. No EPSS score, SSVC decision, KEV entry, or POC was provided, so exploitation probability cannot be quantified from the input; the vendor advisory (GHSA-h89q-4j2h-7h88) and two fix commits confirm the flaw is real and patched. Net: a genuine, easy-to-exploit information-disclosure bug for anyone running exposed publish mode, but likely limited real-world blast radius given SiYuan's niche, self-hosted deployment profile - treat as high priority only if you publish notebooks publicly.

An attacker who can reach a publicly published SiYuan instance sends a crafted POST /api/search/fullTextSearchBlock request in a non-SQL search mode, placing a UNION SELECT payload inside the paths filter that projects an allowed visible box and path. The response returns block rows from hidden (non-published) documents, disclosing private notes without any credentials. No public POC is referenced, but the low attack complexity makes manual exploitation straightforward.