CVE-2026-69085
CRITICAL
CVSS 9.9
siyuan
Verified Advisory
SQL injection in SiYuan searchDocs endpoint via unescaped keyword (CVE-2026-69085)
The `/api/filetree/searchDocs` endpoint in SiYuan concatenates the caller-supplied `keyword` parameter directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish `RoleReader` token, or unauthenticated when `Publish.Auth.Enable` is set to false. Because the SQLite handle is read-write and the driver executes stacked semicolon-separated statements, an attacker can read and modify database content across all cleartext notebooks on the instance.
Affected versions:
- <=v3.7.2
We recommend updating to: v3.7.3.
CVSS 9.9 · our assessment: act_now
Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-33jq-p8c2-q3q4
Details: https://vuln.today/cve/CVE-2026-69085
Verified by vuln.today against published advisories.
Affected versions
- – <=v3.7.2
Fixed in: v3.7.3
More advisories for siyuan
- CVE-2026-73608 – Missing authorization in SiYuan getAttributeViewSearchTarget endpoint (CVE-2026-73608)
- CVE-2026-72804 – Missing publish-password check in SiYuan graph API endpoints (CVE-2026-72804)
- CVE-2026-72795 – Publish-access bypass in SiYuan embedded block endpoints (CVE-2026-72795)
- CVE-2026-72794 – Session cookie signing key disclosure in siyuan via getConf endpoint (CVE-2026-72794)
- CVE-2026-72798 – Information disclosure in SiYuan publish-mode attribute view filter (CVE-2026-72798)
- CVE-2026-72793 – Sensitive configuration disclosure in SiYuan via /api/system/getConf (CVE-2026-72793)
- CVE-2026-72789 – Authorization bypass in SiYuan encrypted notebook publish access gate (CVE-2026-72789)
- CVE-2026-68584 – Authentication bypass in SiYuan publish-mode password-protected documents (CVE-2026-68584)