CVE-2026-69085: SiYuan before v3.7.3 SQL Injection via searchDocs
SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.7.3 - Configuration
If possible, set Publish.Auth.Enable to true (so the /api/filetree/searchDocs endpoint is not reachable unauthenticated when publish mode is enabled).
SiYuan Publish.Auth Enable = false - Configuration
Ensure the /api/filetree/searchDocs endpoint is reachable only via a publish RoleReader token (avoid unauthenticated access via publish mode).
SiYuan /api/filetree/searchDocs endpoint access publish mode authentication requirement = require RoleReader token
Event History
Frequently Asked Questions
What is the severity of CVE-2026-69085?
The severity of CVE-2026-69085 is rated as critical with a score of 10.
How do I fix CVE-2026-69085?
To fix CVE-2026-69085, upgrade to SiYuan version 3.7.3 or later, which addresses the SQL injection vulnerability.
What type of vulnerability is CVE-2026-69085?
CVE-2026-69085 is an SQL injection vulnerability affecting SiYuan before version 3.7.3.
What impact does CVE-2026-69085 have?
CVE-2026-69085 allows attackers to execute arbitrary SQL queries, potentially leading to data compromise.
Who is affected by CVE-2026-69085?
Users of SiYuan versions prior to 3.7.3 are affected by CVE-2026-69085, particularly those utilizing the /api/filetree/searchDocs endpoint.