Skip to main content

SiYuan EUVDEUVD-2026-52277

| CVE-2026-69084 CRITICAL
SQL Injection (CWE-89)
2026-08-03 VulnCheck GHSA-p2x7-4c4p-8wh6
SQLi Siyuan
9.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.9 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
10.0 CRITICAL

Remote unauthenticated endpoint reachable anonymously when publish auth is disabled (PR:N/AC:L); stacked SQL grants full read/write to the DB (C:H/I:H), and impact crossing into the shared DB across notebooks justifies S:C; no direct availability impact claimed (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Aug 03, 2026 - 14:27 vuln.today
Patch available
Aug 03, 2026 - 14:02 EUVD
CVE Published
Aug 03, 2026 - 13:20 cve.org
CRITICAL 9.9

DescriptionCVE.org

SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the underlying driver executes stacked statements, an attacker can read and modify content across all opened cleartext notebooks (encrypted per-box notebooks are excluded). Fixed in v3.7.3.

AnalysisAI

SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements verbatim to the primary read-write siyuan.db handle via the /api/search/searchEmbedBlock endpoint. Because the endpoint is gated only by CheckAuth, it is reachable with the low-privilege publish RoleReader token - and by fully anonymous users when publish authentication is disabled - and the driver's support for stacked statements allows both reading and modifying content across all opened cleartext notebooks. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach exposed SiYuan API over network
Delivery
POST stacked SQL to /api/search/searchEmbedBlock
Exploit
Statement passed verbatim to read-write siyuan.db
Execution
Driver executes stacked read+write statements
Impact
Exfiltrate and modify cleartext notebook content
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires network reachability to the SiYuan HTTP API endpoint /api/search/searchEmbedBlock on a vulnerable instance (<= v3.7.2). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals are strongly aligned toward high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach a self-hosted SiYuan publish endpoint (either anonymously where publish auth is disabled, or with a low-privilege RoleReader token) sends a crafted request to /api/search/searchEmbedBlock containing a stacked SQL payload. The first statement exfiltrates block content from cleartext notebooks, while a trailing statement (after a semicolon) issues UPDATE/DELETE/INSERT operations to tamper with or destroy notes. …
Remediation Vendor-released patch: upgrade to SiYuan v3.7.3 or later, which fixes the endpoint per GHSA-vh22-h7hf-www7 (https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vh22-h7hf-www7). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: audit all systems running SiYuan version 3.7.2 or earlier; if public authentication is disabled, immediately restrict network access to the /api/search/searchEmbedBlock endpoint. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Siyuan

View all
CVE-2024-53507 CRITICAL POC
9.8 Nov 29

A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), t
CVE-2024-53506 CRITICAL POC
9.8 Nov 29

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. R
CVE-2024-53505 CRITICAL POC
9.8 Nov 29

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated criti
CVE-2024-53504 CRITICAL POC
9.8 Nov 29

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated c
CVE-2026-23852 CRITICAL POC
9.6 Jan 19

SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code ex
CVE-2026-54069 CRITICAL POC
9.2 Jun 24

Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chro
CVE-2026-29183 CRITICAL POC
9.3 Mar 06

Reflected XSS in SiYuan knowledge management before 3.5.9.
CVE-2026-25539 CRITICAL POC
9.1 Feb 04

SiYuan knowledge management system prior to 3.5.5 has a path traversal in /api/file/copyFile allowing arbitrary file ope
CVE-2024-2692 CRITICAL POC
9.0 Apr 04

SiYuan version 3.0.3 allows executing arbitrary commands on the server. Rated critical severity (CVSS 9.0), this vulnera
CVE-2026-29073 HIGH POC
8.8 Mar 06

SQL injection in SiYuan prior to version 3.6.0 allows any authenticated user, including those with read-only access, to

CVE-2026-34605 HIGH POC
8.6 Mar 31

Cross-site scripting (XSS) in SiYuan personal knowledge management system versions 3.6.0-3.6.1 allows remote attackers t
CVE-2026-54066 HIGH POC
7.5 Jun 24

Arbitrary file disclosure in SiYuan personal knowledge management system before 3.7.0 lets an unauthenticated remote att

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Share

EUVD-2026-52277 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy