SQL injection in SiYuan fullTextSearchAssetContent endpoint (CVE-2026-69083)

The `/api/search/fullTextSearchAssetContent` endpoint in SiYuan exposes two SQL injection flaws on the asset-content database. Method 2 passes a client-supplied SQL statement directly to a read-write database handle with no single-statement or read-only guard and no admin restriction, while method 3 builds a REGEXP clause by concatenating an unsanitized client expression, allowing SQL breakout. Both flaws are reachable by publish RoleReader tokens and by unauthenticated users when Publish.Auth.Enable is false, permitting arbitrary read, modification, or deletion of cross-notebook asset-content data. Affected versions: - <=v3.7.2 We recommend updating to: v3.7.3. CVSS 9.9 · our assessment: act_now Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fph3-ghq9-vw66 Details: https://vuln.today/cve/CVE-2026-69083