{"uuid": "7326db5c-a8a7-48f6-acb3-62b1cbf4b920", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54068", "type": "seen", "source": "https://gist.github.com/alon710/5b22d6c437eabc82b89ba6fa8ccee27d", "content": "# CVE-2026-54068: CVE-2026-54068: Unauthenticated Server-Side Template Injection and SQLite Exfiltration in SiYuan PKM\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-07-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54068\n\n## Summary\nAn authentication bypass in the SiYuan personal knowledge management system before version 3.7.0 exposes a dynamic icon rendering endpoint. This endpoint processes client-supplied Go template directives. By submitting a crafted request, an unauthenticated remote attacker can leverage registered database template functions to execute arbitrary read-only SQL queries and exfiltrate workspace contents.\n\n## TL;DR\nAn unauthenticated API endpoint in SiYuan PKM before 3.7.0 evaluates user-controlled input using the Go template engine. Remote attackers can leverage registered SQL helper functions to query the underlying SQLite database and exfiltrate notes, credentials, and system metadata.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.9 (Medium)\n- **EPSS Score**: 0.00239 (Percentile Rank: 14.92%)\n- **Impact**: High Confidentiality Leakage\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Open-Source Personal Knowledge Management System\n- **siyuan**: < 3.7.0 (Fixed in: `3.7.0`)\n\n## Mitigation\n\n- Upgrade SiYuan to version 3.7.0 or newer.\n- Restrict network access to the SiYuan API and web UI using reverse proxies or firewall ACLs.\n- Monitor HTTP access logs for requests containing the .action parameter targeting /api/icon/getDynamicIcon.\n\n**Remediation Steps:**\n1. Verify the running version of SiYuan using the version endpoint or the application UI.\n2. Update the Docker image or localized installation to version 3.7.0.\n3. Restart the service and confirm that accessing /api/icon/getDynamicIcon without an authorization header yields an HTTP 401 Unauthorized response.\n\n## References\n\n- [GitHub Security Advisory GHSA-gcm7-57gf-953c](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gcm7-57gf-953c)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54068) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-11T04:41:43.033051Z"}