SiYuan, an open‑source personal knowledge management system, suffered an unauthenticated SQL injection flaw in its block search endpoint (POST /api/search/fullTextSearchBlock). Prior to version 3.7.1 the server concatenated attacker‑controlled path values into SQL predicates used by non‑SQL search modes, enabling a UNION SELECT to retrieve rows from hidden documents that a visitor can access via the public publish URL without any authentication, thereby jeopardising confidentiality of unpublished information.

Vendors affected include Siyuan Note (SiYuan). Any deployment of SiYuan with a version earlier than 3.7.1 is vulnerable; the issue was remedied in release 3.7.1 and later versions are not affected.

The CVSS score of 7.5 reflects a high‑severity vulnerability with a moderate impact on confidentiality. The EPSS score of < 1% indicates a very low but non‑zero exploitation probability, but the lack of a KEV listing suggests that no widely distributed exploits are known. The attack vector is likely through unauthenticated web requests to the search API, which an attacker could trigger from a remote client that includes a UNION SELECT clause. a classic SQL injection (CWE‑89) indicates that it application fails to validate or escape user input.