/Vulnerability Library

SiYuan <=3.7.2 - SQL Injection

CVE-2026-69085
Verified

Description

SiYuan before v3.7.3 contains a SQL injection caused by direct concatenation of the keyword parameter in /api/filetree/searchDocs endpoint, letting attackers with publish RoleReader token or unauthenticated in publish mode read and modify database content.

Severity

Critical

CVSS Score

10

Exploit Probability

1%

Affected Product

siyuan

Published Date

September 11, 2026

Template Author

str4k3r

CVE-2026-69085.yaml
10.0Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CVE ID:
cve-2026-69085
CWE ID:
cwe-89

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-33jq-p8c2-q3q4https://github.com/siyuan-note/siyuan/releases/tag/v3.7.3https://hub.docker.com/r/b3log/siyuan/tagshttps://nvd.nist.gov/vuln/detail/CVE-2026-69085

Remediation Steps

Update to version 3.7.3 or later.