CVE-2026-87807: SiYuan SQL Injection Vulnerability

CVE-2026-87807 Overview

CVE-2026-87807 is an authenticated SQL injection vulnerability [CWE-89] in SiYuan, a personal knowledge management application. Versions before v3.8.2 fail to sanitize the method=1 query parameter in the fullTextSearchBlock endpoint. Authenticated attackers can inject UNION SELECT statements to read arbitrary rows from the blocks table. This bypasses publish-access controls that normally restrict which documents unauthenticated or limited users can view. The result is disclosure of all document content and sensitive attributes stored in the application database.

Critical Impact
Any authenticated user can extract the entire contents of the SiYuan blocks table, exposing private notes, credentials, and metadata regardless of publish-access restrictions.

Affected Products

SiYuan versions prior to v3.8.2
The fullTextSearchBlock API endpoint with the method=1 query parameter
Deployments exposing the SiYuan API to authenticated users over the network

Discovery Timeline

2026-09-09 - CVE-2026-87807 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87807

Vulnerability Analysis

The fullTextSearchBlock endpoint accepts a method query parameter that controls how SiYuan constructs the underlying SQL search query. When method=1 is supplied, the application concatenates user-controlled input directly into the SQL statement without parameterization. Attackers append UNION SELECT clauses to the injected query and return arbitrary columns from any table accessible to the application database user. Because SiYuan stores all document blocks and their attributes in the blocks table, a single crafted request can dump the full knowledge base. The vulnerability also defeats the publish-access model, which enforces per-document visibility at the application layer rather than at the database layer.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The method=1 code path builds its query through string concatenation rather than using prepared statements or parameter binding. See the GitHub Security Advisory GHSA-336w-67gx-gx2h for maintainer analysis.

Attack Vector

Exploitation requires network access to the SiYuan API and valid authentication. An attacker submits a crafted request to the fullTextSearchBlock endpoint with a malicious value in the search parameter under method=1. The injected UNION SELECT returns rows from the blocks table in the search response. No user interaction is required beyond issuing the request. Refer to the VulnCheck SQL Injection Advisory for exploitation notes.

No verified proof-of-concept code is published in the referenced advisories. The vulnerability mechanism is a classic UNION-based SQLi against a concatenated search query.

Detection Methods for CVE-2026-87807

Indicators of Compromise

HTTP requests to /api/search/fullTextSearchBlock containing method=1 alongside SQL keywords such as UNION, SELECT, --, or /* in the search payload.
Unusually large or structurally anomalous responses from the fullTextSearchBlock endpoint that return columns unrelated to normal search results.
Authenticated sessions issuing repeated fullTextSearchBlock calls with varied payloads, consistent with injection probing.

Detection Strategies

Deploy web application firewall rules that inspect request bodies to the SiYuan search API for SQL metacharacters and UNION SELECT patterns.
Enable database query logging on the SQLite backend used by SiYuan and alert on queries containing UNION referencing the blocks table from the search code path.
Correlate authenticated user IDs with high-volume search activity to surface accounts performing bulk data extraction.

Monitoring Recommendations

Baseline normal request volume and payload length for the fullTextSearchBlock endpoint and alert on deviations.
Forward SiYuan application and reverse-proxy logs to a centralized log platform for retention and query.
Monitor outbound network egress from SiYuan hosts for signs of bulk exfiltration following suspected injection activity.

How to Mitigate CVE-2026-87807

Immediate Actions Required

Upgrade SiYuan to version 3.8.2 or later on all instances, including self-hosted deployments and Docker containers.
Rotate any credentials, API tokens, or secrets that may have been stored in SiYuan documents accessible via the blocks table.
Audit authentication logs and API access logs for suspicious fullTextSearchBlock activity prior to patching.

Patch Information

The SiYuan maintainers released version 3.8.2 to address CVE-2026-87807. Full remediation details are documented in the GitHub Security Advisory GHSA-336w-67gx-gx2h. Users on unsupported branches should migrate to the fixed release.

Workarounds

Restrict network access to the SiYuan API using firewall rules, VPN gating, or reverse-proxy allowlists until the patch is applied.
Disable or tightly restrict account provisioning to reduce the population of authenticated users who can reach the vulnerable endpoint.
Place a web application firewall in front of SiYuan and block requests to fullTextSearchBlock containing SQL injection signatures such as UNION, SELECT, and inline comment sequences.

bash

# Example nginx location block to restrict access to the vulnerable endpoint
location /api/search/fullTextSearchBlock {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://siyuan_backend;
}