SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content

Summary Siyuan's block search endpoint concatenates attacker-controlled paths values into SQL predicates used by non-SQL search modes. Through Siyuan's publish service, an unauthenticated visitor is forwarded to the kernel with a reader-role token and can reach POST /api/search/fullTextSearchBloc...