Loading story…
A high-severity SQL injection vulnerability, tracked as CVE-2026-69085, affects SiYuan before v3.7.3 in the /api/filetree/searchDocs endpoint. The flaw stems from the keyword parameter being concatenated directly into SQL queries without escaping or parameter binding, enabling attackers to inject arbitrary SQL through network access with low complexity and no user interaction.
The vulnerable endpoint is reachable with a publish RoleReader token and, in some deployments, without authentication when publish mode is enabled and Publish.Auth.Enable is set to false. Because the injected SQL runs on a read-write SQLite connection that supports stacked statements, attackers can read and modify database contents across all cleartext, non-encrypted notebooks on the affected instance. The issue is classified as CWE-89 and carries a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
The CVE entry states that disclosure@vulncheck.com received the new CVE for the SiYuan SQL injection vulnerability. The issue affects SiYuan before version 3.7.3 and involves the /api/filetree/searchDocs endpoint.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SiYuan versions through **3.7.2** contain a critical SQL injection vulnerability, tracked as `CVE-2026-69084`, in the `/api/search/searchEmbedBlock` endpoint. The flaw allows attacker-controlled SQL to be passed directly to the main read-write `siyuan.db` database handle without single-statement, read-only, or administrative restrictions, creating a path to unauthorized database access and manipulation. The endpoint is protected only by **CheckAuth**, which means it can be reached by users holding the publish **RoleReader** token and, in some deployments, by anonymous users when publish authentication is disabled. Because the underlying database driver permits stacked statements, attackers can read and modify content across all opened cleartext notebooks, although encrypted per-box notebooks are not exposed through this issue. The vulnerability is classified as **CWE-89** and was fixed in **SiYuan 3.7.3**.
Aug 4, 2026
A critical SQL injection flaw tracked as **`CVE-2026-72811`** affects **SiYuan** versions before **`3.7.4`**, allowing remote attackers to execute arbitrary SQL through the application's backlink and mention search functionality. The bug stems from unsafe construction of a SQL `MATCH` query in `kernel/model/backlink.go`, where stored block metadata and user-supplied keywords are concatenated into a search statement with incomplete escaping, letting attackers break out of string literals using single quotes. The vulnerability is remotely reachable through the publish surface, including by anonymous users or users with **RoleReader** access, and can also be exploited as a second-order injection via stored document metadata. Because the query runs against the main read-write **`siyuan.db`** handle and the database driver supports statement stacking, successful exploitation can result in arbitrary SQL execution and cross-notebook read and write access. The issue is classified as **CWE-89**, carries a **CVSS v3.1 score of 10.0** and **CVSS v4.0 score of 9.9**, and is fixed in **SiYuan `3.7.4`**.
Aug 14, 2026
SiYuan disclosed two high-severity vulnerabilities affecting its personal knowledge management platform, including an arbitrary file-read issue tracked as **`CVE-2026-32938`** and a stored XSS flaw tracked as **`CVE-2026-34448`**. In SiYuan **3.6.0 and earlier**, the desktop publish service endpoint **`/api/lute/html2BlockDOM`** could copy local files referenced through **`file://`** links into the workspace assets directory without properly validating sensitive paths. Because authenticated users could then access **`GET /assets/*path`**, a publish-service visitor could exfiltrate readable local files from the desktop environment. The issue was fixed in **3.6.1**. A separate flaw in SiYuan **before 3.6.2** allowed an attacker to plant a malicious URL in an Attribute View field and trigger stored XSS when a victim opened Gallery or Kanban views configured with **"Cover From -> Asset Field"**. The application accepted arbitrary HTTP(S) URLs without extensions as images and injected them into an **`<img src="...">`** attribute without escaping. In the Electron desktop client, where **`nodeIntegration`** was enabled and **`contextIsolation`** was disabled, the XSS could escalate to arbitrary operating-system command execution under the victim’s account. SiYuan patched the command-execution path in **3.6.2**, leaving affected organizations to prioritize upgrades across both releases.
Jun 29, 2026