CVE-2026-126266
Deferred Deferred - Pending Action

SiYuan Information Disclosure via Regex Search

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod 3 and a broad regex to read protected body text returned in the unfiltered keywords field.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126266
EUVD
EUVD-2026-125255

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan From 3.6.0 (inc) to 3.8.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan versions 3.6.0 to 3.8.9 have an information disclosure flaw where unauthenticated users can bypass document passwords. By sending a POST request to /api/filetree/getDoc with queryMethod 3 and a broad regex pattern, attackers can retrieve protected document content from the unfiltered keywords field without needing the password.

Detection Guidance

To detect this vulnerability, monitor network traffic for POST requests to /api/filetree/getDoc with queryMethod set to 3 and regex patterns in the request body. Check server logs for unusual access to protected documents without authentication.

Impact Analysis

Unauthorized access to sensitive documents protected by per-document passwords. Attackers can read confidential content without authentication, potentially exposing private data, notes, or other sensitive information stored in SiYuan.

Compliance Impact

This vulnerability could lead to violations of GDPR (data protection) and HIPAA (health information privacy) by exposing sensitive personal or health data. Organizations using SiYuan for regulated data must address this to maintain compliance.

Mitigation Strategies

Immediately upgrade SiYuan to version 3.8.9 or later to patch the vulnerability. If upgrading is not possible, restrict access to the /api/filetree/getDoc endpoint and disable regex search functionality for unauthenticated users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126266. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...