CVE-2026-69083

SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent

View on CVE.org
Published Aug 3, 2026 CVSS 4.0 · 9.9 Critical EPSS < 1% KEV · Not listed
Description
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.

Analysis

AI-generated

Technical impact

The vulnerability is an SQL Injection (CWE‑89) in the fullTextSearchAssetContent endpoint of SiYuan. Unauthenticated users can supply malicious parameters, including REGEXP clauses, that are incorporated into raw SQL queries without proper escaping. This allows an attacker to execute arbitrary SQL commands against the read‑write asset‑content database, enabling them to read, modify, or delete data across any notebook.

Affected Systems

SiYuan Note versions prior to 3.7.3 are affected. All deployments using these versions expose the vulnerable fullTextSearchAssetContent endpoint and therefore are susceptible to exploitation.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.9, indicating critical severity. EPSS data is not available, but the lack of authentication prerequisites and the broad data impact make it highly attractive for adversaries. The vulnerability is not yet listed in CISA's KEV catalog, but its exploitation potential warrants immediate attention. Attackers can reach the endpoint over the network without credentials, making the attack vector straightforward and low‑effort.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply SiYuan v3.7.3 or later to remove the vulnerability
  • Restrict unauthenticated access to the fullTextSearchAssetContent endpoint through firewall rules or network segmentation
  • Disable or isolate RoleReader token functionality until a patch is applied

Generated by OpenCVE AI on August 4, 2026 at 10:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-fph3-ghq9-vw66 SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB
History
Type Values Removed Values Added
First Time appeared B3log
B3log siyuan
CPEs cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*
Vendors & Products B3log
B3log siyuan
Type Values Removed Values Added
First Time appeared Siyuan
Siyuan siyuan
Vendors & Products Siyuan
Siyuan siyuan
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.
Title SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N'}

cvssV4_0

{'score': 9.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N'}
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Aug 14, 2026, 4:51 PM
Reserved
Aug 3, 2026, 10:42 AM

View source JSON

Updated
Aug 3, 2026, 2:42 PM

JSON

Status
Deferred
Published
Aug 3, 2026, 2:16 PM
Modified
Oct 23, 2026, 9:10 PM

View source JSON

No data.

Updated
Aug 4, 2026, 10:30 AM

JSON