CVE-2026-29073: b3log Siyuan

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directly, but it only checks basic auth, not admin rights, any logged-in user, even readers, can run any sql query on the database. This issue has been patched in version 3.6.0.

Affected products

• b3log Siyuan: up to and including 3.5.9

Published 2026-03-06. Last modified 2026-06-17.