CVE-2026-126266 · Package
NO FIX YET · SEE WHAT TO DO
SiYuan versions from 3.6.0 before 3.8.9 let unauthenticated visitors to a published site bypass per-document passwords through a regex search on the getDoc endpoint. An attacker can read the body text of protected documents from the keywords field of the response.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Anyone running a self-hosted SiYuan instance from 3.6.0 up to but not including 3.8.9 with publishing turned on and password-protected documents. Instances that do not publish, or that publish without per-document passwords, are not exposed by this flaw.
Not affected if no-password-protected-docs, publishing-disabled, version-3.8.9-or-later
Who cares publishing, self-hosted, siyuan
3.6.0 through 3.8.9 (exclusive) are affected.3.8.9 or later.SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod 3 and a broad regex to read protected body text returned in the unfiltered keywords field.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.