Critical SQL Injection Found in SiYuan

Security researchers have identified a critical SQL injection vulnerability, tracked as CVE-2026-69085, affecting SiYuan versions prior to 3.7.3. The flaw exists within the /api/filetree/searchDocs endpoint and allows for unauthorized database access, potentially leading to full data compromise of non-encrypted notebooks.

What's at Risk

The vulnerability affects all instances of SiYuan running versions earlier than 3.7.3. Organizations and individual users deploying SiYuan in environments where the software is internet-facing or where the publish mode is enabled are at the highest risk.

Because the flaw can be triggered without authentication when specific configuration settings are active, any exposed instance is susceptible to remote exploitation. The impact is severe, as the vulnerability allows for both the reading and modification of data stored in cleartext notebooks.

How the Flaw Works

SQL injection is a common class of vulnerability that occurs when an application fails to properly sanitize user-supplied input before including it in a database query. In general, this allows an attacker to manipulate the structure of the SQL statement being executed by the backend database.

When a database driver supports stacked queries, an attacker can append additional malicious commands to the original request. This can result in unauthorized data exfiltration, the modification of existing records, or in some configurations, the deletion of entire database tables. By bypassing input validation, attackers can interact directly with the database layer, effectively circumventing the application's intended access controls.

How to Protect Your Systems

• Update your SiYuan installation immediately to version 3.7.3 or later to apply the necessary security fixes.
• Review your instance configuration and ensure that Publish.Auth.Enable is set to true if your deployment is accessible over the internet.
• Audit your database contents for any signs of unauthorized modification or unexpected data entries.
• Restrict network access to your SiYuan instance by placing it behind a VPN or firewall to limit exposure to untrusted networks.
• Implement regular, encrypted backups of your notebook data to ensure recovery in the event of a security incident.

Given the critical CVSS score of 10, the potential for unauthorized data modification is a significant concern for all users. Promptly applying the vendor patch is the only effective way to neutralize this threat. Organizations should prioritize this update to prevent potential data integrity loss and unauthorized access to sensitive information stored within their notebook files.