CVE-2026-69085Critical SQL Injection in SiYuan allows notebook modification
SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.
View on NVDAnalysis
SiYuan presenta una vulnerabilidad de inyección SQL crítica en su API de búsqueda que permite a atacantes remotos leer o modificar el contenido de todas las libretas sin cifrar. Debido al uso de sentencias apiladas, un atacante puede comprometer la base de datos completa incluso sin estar autenticado si el modo de publicación está activo. Se recomienda actualizar inmediatamente a la versión 3.7.3 para evitar la pérdida o manipulación de información técnica y personal.
Relevant roles
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:NCWE-89EPSS
No EPSS score yet (CVE may be too fresh).
Technical description
SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.