SiYuan vulnerabilities

SiYuan is an open-source personal knowledge management system. In versions prior to 3.7.0, a vulnerability allowed an unauthenticated attacker to read arbitrary files in WorkspaceDir by double URL-encoding in the /assets/*path route.

In SiYuan personal knowledge management system prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, the filter FilterBlocksByPublishAccess treats a nil context as authorized, skipping the publish password check and returning bookmarked blocks from protected documents.