CVE-2026-69085 Details
Description
SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.
A SQL injection vulnerability has been identified in SiYuan versions prior to 3.7.3, specifically within the '/api/filetree/searchDocs' endpoint. The vulnerability arises because the keyword parameter provided by the caller is directly concatenated into SQL statements without proper escaping or parameter binding. This endpoint can be accessed by a publish RoleReader token or, when publish mode is enabled with 'Publish.Auth.Enable' set to false, by unauthenticated users. The injection occurs on a read-write SQLite database through a driver that allows stacked (semicolon-separated) statements. As a result, an attacker could read and alter database content across all unencrypted notebooks on the instance.
Users are advised to update SiYuan to version 3.7.3 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 3, 2026CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-33jq-p8c2-q3q4 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-33jq-p8c2-q3q4 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-searchdocs | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SiYuan | <= v3.7.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |