Vulnerability Description
SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search criteria from data/storage/criteria.json without the publish-access filtering used by sibling storage endpoints, allowing a publish-mode Reader to read private document paths, notebook, document, and block IDs, and search and replace keywords for unpublished documents. This issue is fixed in versions 3.7.1.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/siyuan-note/siyuan/commit/0049d0f04ffe9837760d29248b9ef316050
- https://github.com/siyuan-note/siyuan/releases/tag/v3.7.1
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-px3c-cf92-9g83
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-px3c-cf92-9g83
FAQ
What is CVE-2026-59853?
CVE-2026-59853 is a vulnerability with a CVSS score of 6.5 (MEDIUM). SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search criteria from data/storage/criteria.json without the publish-a...
How severe is CVE-2026-59853?
CVE-2026-59853 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-59853?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.