CVE-2026-69085 in siyuan
Summary
by MITRE • 08/03/2026
SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability exists in SiYuan versions prior to 3.7.3 within the /api/filetree/searchDocs endpoint which processes user-supplied keyword parameters without proper input sanitization or parameter binding. The flaw represents a classic sql injection vulnerability that allows attackers to execute arbitrary sql commands against the underlying sqlite database through direct concatenation of user input into sql statements. The vulnerability is particularly concerning because it operates on a read-write database handle using a driver that supports stacked queries, enabling attackers to chain multiple sql operations separated by semicolons. The endpoint is accessible to users with publish RoleReader tokens or completely unauthenticated when the publish mode is enabled with Publish.Auth.Enable set to false, significantly expanding the attack surface.
The technical implementation of this vulnerability stems from improper input validation and sanitization practices within the application's api layer. When a user submits a search query through the keyword parameter, the system directly incorporates this input into sql queries without any form of escaping or parameter binding mechanisms. This design flaw allows an attacker to inject malicious sql payloads that can manipulate the database structure and content. The use of sqlite with a driver supporting stacked statements amplifies the impact as attackers can execute multiple commands sequentially, potentially leading to complete database compromise.
The operational impact of this vulnerability extends beyond simple data theft, as it provides attackers with full read-write access to all cleartext notebooks within the siyuan instance. This means that unauthorized users could not only extract sensitive information but also modify, delete, or corrupt database content across all accessible notebooks. The vulnerability affects all cleartext notebooks specifically since encrypted notebooks would require additional authentication mechanisms, but the unauthenticated access path allows for broad exploitation. Attackers could potentially modify search results, inject malicious content, or even escalate privileges within the system.
Security mitigations should focus on implementing proper input validation and parameter binding mechanisms to prevent sql injection attacks. The immediate solution involves updating to siyuan version 3.7.3 or later where the vulnerability has been patched. Additionally, organizations should implement proper access controls by disabling publish mode when authentication is not required, and ensuring that all user inputs are properly sanitized before being incorporated into database queries. The implementation should follow established security practices such as using prepared statements with parameter binding, input validation, and output encoding to prevent similar vulnerabilities from occurring in other parts of the application.
This vulnerability aligns with common weakness enumeration cwes 89 sql injection and 770 allocation of resources without limits or throttling, representing a critical security risk that could lead to complete system compromise. The attack pattern follows typical sql injection techniques documented in the mitre att&ck framework under technique id t1190 exploitation for client execution and t1074 data staging, where attackers can manipulate database content through malicious input parameters. Organizations should also consider implementing web application firewalls and intrusion detection systems to monitor for suspicious sql injection patterns and prevent exploitation attempts against similar vulnerabilities in other applications within their infrastructure.