Description
SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod 3 and a broad regex to read protected body text returned in the unfiltered keywords field.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| siyuan-note | siyuan | 3.6.0 – < 3.8.9 | 3.8.9 |
References
- GitHub Security Advisory (GHSA-qf37-w288-frvq) vendor-advisory
- VulnCheck Advisory: SiYuan from 3.6.0 before 3.8.9 Publish-Password Bypass via getDoc Regex Keywords third-party-advisory