CVE-2026-69085Inyección SQL crítica en SiYuan permite modificar libretas
SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.
Ver en NVDAnálisis
SiYuan presenta una vulnerabilidad de inyección SQL crítica en su API de búsqueda que permite a atacantes remotos leer o modificar el contenido de todas las libretas sin cifrar. Debido al uso de sentencias apiladas, un atacante puede comprometer la base de datos completa incluso sin estar autenticado si el modo de publicación está activo. Se recomienda actualizar inmediatamente a la versión 3.7.3 para evitar la pérdida o manipulación de información técnica y personal.
Roles relevantes
Severidad
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:NCWE-89EPSS
Sin puntaje EPSS aún (CVE muy reciente).
Descripción técnica
SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.