CVE-2026-100644 in SiYuan
Summary
by MITRE • 09/26/2026
SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database rows from all notebooks.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The SiYuan note-taking application, prior to version 3.8.4, contains a critical security flaw within its graph query endpoint that allows for unauthenticated remote code execution through structured query language injection. This vulnerability stems directly from improper input validation and the failure to utilize parameterized queries or prepared statements when handling user-supplied data. Specifically, the dailyNoteSavePath parameter is concatenated directly into SQL commands without any sanitization or escaping mechanisms in place. In secure software development practices, all dynamic inputs must be treated as untrusted and processed through strict whitelisting or bound parameters to prevent interpretation of input strings as executable code. The absence of these safeguards creates a classic injection vector that attackers can exploit to manipulate the underlying database structure and content.
From an operational perspective, this vulnerability poses a severe risk to data integrity and confidentiality for any instance of SiYuan where authentication is disabled on published sites. Because the endpoint does not require valid credentials, unauthenticated actors located anywhere on the network can interact with the application directly. By crafting malicious payloads that utilize UNION SELECT statements, attackers can bypass intended query logic and extract arbitrary rows from all notebooks stored in the database. This capability effectively grants full read access to sensitive user data, including personal notes, organizational structures, and potentially other metadata associated with the note-taking system. The impact is particularly acute because it affects all notebooks rather than isolated instances, leading to a comprehensive compromise of the application's data layer.
This vulnerability aligns closely with Common Weakness Enumeration identifier CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The exploitation technique described involves UNION-based injection, where additional SELECT statements are appended to the original query to retrieve data from different tables or columns than originally intended. In terms of the MITRE ATT&CK framework, this activity falls under the T1059 category for Command and Scripting Interpreter, specifically within sub-techniques related to SQL commands used in application layer attacks such as T1190 Exploit Public-Facing Application. The attacker leverages a public-facing interface that lacks proper access controls to execute arbitrary database queries, demonstrating a failure in both input validation and authentication enforcement mechanisms.
To mitigate this vulnerability, immediate action is required for all administrators running versions of SiYuan earlier than 3.8.4. The primary remediation step is to upgrade the application to version 3.8.4 or later, where the developers have implemented proper parameterization for the dailyNoteSavePath parameter and other potentially vulnerable inputs. Until an upgrade can be performed, administrators should enforce strict authentication on all published sites to prevent unauthenticated access to the graph query endpoint. Additionally, implementing a Web Application Firewall with rules specifically designed to detect SQL injection patterns in URL parameters or POST bodies can provide a layer of defense against exploitation attempts. Regular security audits and code reviews focusing on database interaction layers are essential to ensure that future development adheres to secure coding standards such as OWASP Top Ten guidelines regarding injection prevention.