CVE-2026-45148 — SiYuan is an open-source personal knowledge management

title: CVE-2026-45148 - SiYuan Search Asset Metadata Exposure
id: scw-2026-05-14-ai-1
status: experimental
level: medium
description: |
  Detects attempts to exploit CVE-2026-45148 by querying specific search functions (searchAsset, searchTag, searchWidget, searchTemplate) in SiYuan, which can lead to unauthorized enumeration of metadata from documents invisible to the publish service. This rule specifically targets the vulnerable API endpoints used in the exploit.
author: SCW Feed Engine (AI-generated)
date: 2026-05-14
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-45148/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri-query|contains:
          - 'searchAsset'
          - 'searchTag'
          - 'searchWidget'
          - 'searchTemplate'
      cs-method: 
          - 'GET'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse