CVE-2026-54068: siyuan-note siyuan

Vulnerability summary

CVE-2026-54068 is a medium (CVSS 5.9) vulnerability in siyuan-note siyuan. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30% of scored vulnerabilities.

Timeline

1. 24-06-2026
   PublishedVulnerability first disclosed.
2. 25-06-2026
   Last modifiedVulnerability information updated.

Description

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the /api/icon/getDynamicIcon endpoint is explicitly excluded from authentication in SiYuan's kernel router (router.go, "不需要鉴权" -- no auth needed). When called with type=8 and a valid block id parameter, this endpoint invokes RenderDynamicIconContentTemplate, which executes a Go template that includes the querySQL and queryBlocks functions. These functions run arbitrary SELECT statements against the SiYuan SQLite database. An unauthenticated network-adjacent attacker who knows a valid block ID can exfiltrate all user note content, tags, asset references, and block attributes from the database. This vulnerability is fixed in 3.7.0.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.