CVE-2026-69083: SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.7.3 - Compensating control
Ensure the fullTextSearchAssetContent endpoint is not reachable by unauthenticated users (limit access to authenticated clients) and restrict access to RoleReader tokens.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-69083?
CVE-2026-69083 has a severity rating of critical with a score of 10.
How do I fix CVE-2026-69083?
To fix CVE-2026-69083, upgrade to SiYuan version 3.7.3 or later.
What types of attacks can CVE-2026-69083 allow?
CVE-2026-69083 allows attackers to execute arbitrary SQL queries on the database.
Who is affected by CVE-2026-69083?
CVE-2026-69083 affects users of SiYuan versions prior to 3.7.3.
Is authentication required to exploit CVE-2026-69083?
No, CVE-2026-69083 can be exploited by unauthenticated users.