CVE-2026-69083 in siyuan
Summary
by MITRE • 08/03/2026
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/03/2026
The SiYuan note-taking application presents a critical security vulnerability in versions prior to v3.7.3 that allows for unauthorized SQL injection attacks through the fullTextSearchAssetContent endpoint. This vulnerability affects unauthenticated users and those possessing RoleReader tokens, creating an exploitable attack surface that can compromise the integrity and confidentiality of note-taking data across multiple notebooks. The flaw stems from inadequate input validation and parameter sanitization within the application's search functionality, specifically when processing method parameters and REGEXP clauses in database queries.
The technical implementation of this vulnerability involves the application's failure to properly escape or sanitize user-supplied input before incorporating it into SQL query structures. When attackers submit malicious payloads through the fullTextSearchAssetContent endpoint, the system processes these inputs without adequate protection mechanisms, allowing SQL injection attacks to execute. The vulnerability specifically manifests when using REGEXP clauses within database queries, which creates opportunities for attackers to manipulate the underlying database operations. This flaw represents a classic case of improper input handling that enables attackers to bypass authentication mechanisms and gain access to sensitive data stores.
The operational impact of this vulnerability extends beyond simple data exfiltration, as it allows attackers to perform full read, write, and delete operations against the asset-content database. This means that unauthorized users can access cross-notebook data, potentially compromising the privacy and security of information stored across multiple notebooks. The implications are particularly severe given that the vulnerability is accessible to unauthenticated users, eliminating the need for prior authorization or credential compromise. Attackers could potentially modify or delete critical note-taking content, disrupt application functionality, or extract sensitive information from the database.
From a cybersecurity framework perspective, this vulnerability aligns with CWE-89 SQL Injection and follows patterns consistent with ATT&CK technique T1071.004 Application Layer Protocol: DNS, where attackers leverage application interfaces to execute malicious database operations. The vulnerability demonstrates poor input validation practices that violate security principles outlined in the OWASP Top Ten and NIST SP 800-53 security controls. Organizations using SiYuan versions prior to v3.7.3 face significant risk exposure, particularly in environments where sensitive information is stored within note-taking systems.
Mitigation strategies should focus on immediate patching to version 3.7.3 or later, which addresses the SQL injection vulnerability through proper input sanitization and parameterized query execution. Additionally, administrators should implement network-level restrictions to limit access to the vulnerable endpoint, particularly for unauthenticated users. Database access controls should be reviewed and strengthened to ensure that only authorized entities can perform database operations. Regular security assessments of application interfaces should be conducted to identify similar vulnerabilities in other endpoints, while input validation mechanisms should be enhanced throughout the application to prevent similar issues from occurring in future versions.