EUVD-2026-58626

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input publish mode: first-order client keyword and second-order stored document title breakout on read-write handle...

GHSA-Q2VG-7QGX-X5FC SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle

CVE: This vulnerability corresponds to CVE-2026-72811. Summary The backlink/mention search query kernel/model/backlink.go concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement, escaping only the double-quote character ...

SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

CVE: This vulnerability corresponds to CVE-2026-68584. Summary SiYuan's publish mode defines a "protected" access level: a document that is publicly listed but requires a password to read per the product's own UI help text, protected = "Publicly visible, requires password to access". The password...

EUVD-2026-52274

SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc publish mode: reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered...

GHSA-36V8-MPJM-8J5R SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered

CVE: This vulnerability corresponds to CVE-2026-68586. Summary The backlink API splits into list endpoints which documents reference a block and content endpoints the rendered text of those referencing blocks. The list endpoints apply a publish-access filter, the content endpoints do not. As a...

CVE-2026-82654

SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block...

CVE-2026-82654

SiYuan before v3.8.1 is affected by a Stored XSS caused by improper escaping of block name , alias , and memo fields in hint, backlink, and breadcrumb rendering functions. An attacker can set a block's name to contain HTML or script tags that execute when another user views a document referencing...

CVE-2026-72811

SiYuan versions = v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query kernel/model/backlink.go, which concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement while escaping only the...

CVE-2026-72811 SiYuan before v3.7.4 SQL Injection via backlink search

SiYuan versions = v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query kernel/model/backlink.go, which concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement while escaping only the...

PT-2026-71981

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A SQL injection issue exists in the backlink/mention search query within kernel/model/backlink.go. The application concatenates stored block metadata title, name, alias, anchor text and a...

CVE-2026-68586

SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc. While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints gated only by...

CVE-2026-68584

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadingTransaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retriev...

CVE-2026-68586

SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc. While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints gated only by...

CVE-2026-68586 SiYuan before v3.7.3 Content Disclosure via getBacklinkDoc

SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc. While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints gated only by...

CVE-2026-68586 SiYuan before v3.7.3 Content Disclosure via getBacklinkDoc

SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc. While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints gated only by...

CVE-2026-68584

CVE-2026-68584 affects SiYuan before v3.7.3. An authentication bypass exists in publish mode: content endpoints that return headings or backlinks (getHeadingChildrenDOM, getHeading*Transaction, getBacklinkDoc) do not enforce the password check, even though the main getDoc endpoint is protected. A...

EUVD-2026-52272

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeadingTransaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retriev...

PT-2026-67403

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3 Description Insufficient publish-access filters are applied to the content endpoints '/api/ref/getBacklinkDoc' and '/api/ref/getBackmentionDoc'. While backlink list endpoints correctly filter documents forbidden...

Apple macOS 后置链接漏洞

Apple macOS is a proprietary operating system developed by the American company Apple for Mac computers. Versions of Apple macOS Sequoia 15.4 and earlier contained a backlink vulnerability, which was caused by improper handling of symbolic links. This vulnerability could allow applications to...

Dell/Alienware Purchased Apps 后置链接漏洞

Dell/Alienware Purchased Apps is a pre-installed software management tool developed by the American company Dell. Versions of Dell/Alienware Purchased Apps prior to 1.1.32.0 contained a backlink vulnerability. This vulnerability stemmed from improper link resolution before file access, which coul...