CVE-2026-29073

SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directly, but it only checks basic auth, not admin rights, any logged-in user, even readers, can run any sql query on the database. This issue has been patched in version 3.6.0.

Score

CVSS 3.1 8.8 High

Status

Analyzed - security-advisories@github.com

Published

2026-03-06

Last modified

2026-03-09

Weaknesses

CWE-862, CWE-89

Affected products

• Siyuan (B3log)
• Siyuan (Siyuan-note)

References

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jqwg-75qf-vmf9