CVE-2026-100644: SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath
SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database rows from all notebooks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.4
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
Published SiYuan sites with authentication disabled are exposed. An attacker can reach the graph query endpoint remotely without credentials in that configuration.
What can an attacker obtain through this issue?
An attacker can use UNION SELECT injection through the dailyNoteSavePath parameter to extract arbitrary database rows from all notebooks. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.
What version resolves the vulnerability?
The issue affects SiYuan versions before v3.8.4. Upgrade to v3.8.4 or later.