The vulnerability arises from the graph query endpoint that concatenates the dailyNoteSavePath parameter directly into a SQL statement without proper escaping. As a result, unauthenticated users on sites that have been published with authentication disabled can inject arbitrary SQL, such as a UNION SELECT, to read the entire database. This flaw is a classic SQL injection vulnerability identified as CWE‑89 and enables attackers to exfiltrate confidential notebook contents.

All deployments of SiYuan that are running any version prior to 3.8.4 are affected. The affected vendor is Siyuan‑Note as part of the Siyuan desktop and web application. No additional versioning granularity is provided beyond the pre‑3.8.4 threshold.

The CVSS score of 8.7 places the flaw in the high severity range, and the EPSS score is not available, which means the precise exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it directly through the published web interface, using an unauthenticated request with a malicious dailyNoteSavePath value. Because the input is concatenated, the risk is that any notebook data can be retrieved, leading to a confidentiality breach.