CVE-2026-87807

Siyuan versions before v3.8.2 contain an authenticated SQL injection flaw (CWE-89) in the fullTextSearchBlock endpoint, triggered via the method=1 query parameter. An authenticated attacker who can reach the endpoint can submit a crafted method=1 value containing a UNION SELECT statement, causing the underlying database to return arbitrary rows. This lets the attacker read the entire blocks table, bypassing Siyuan's publish-access controls and exposing all document content and sensitive attributes stored in the workspace database. Any deployment running an affected version is exposed, with the greatest risk to self-hosted instances whose web API or publish interface is reachable over a network. There is currently no known public proof-of-concept, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Upgrade Siyuan to v3.8.2 or later to remediate the injection in fullTextSearchBlock. Until upgraded, restrict network access to the Siyuan HTTP API, ensure authentication is enforced on all exposed endpoints, and limit or review any publish-facing configuration. Administrators of internet-exposed instances should verify that publish-access controls were not bypassed by checking for unexpected access to document content.