CVE

CVE-2026-69085

9.9

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

siyuan

Updated Nov 10, 2026View on NVD →

S4E scanner

criticalWeb Vulnerabilities~10 seconds

SiYuan <=3.7.2 - SQL Injection

SiYuan before v3.7.3 contains a SQL injection caused by direct concatenation of the keyword parameter in /api/filetree/searchDocs endpoint, letting attackers with publish RoleReader token or unauthenticated in publish mode read and modify database content. References: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-33jq-p8c2-q3q4 https://github.com/siyuan-note/siyuan/releases/tag/v3.7.3 https://hub.docker.com/r/b3log/siyuan/tags https://nvd.nist.gov/vuln/detail/CVE-2026-69085 Remediation: Update to version 3.7.3 or later.

9 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: siyuan

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →