CVE-2026-69083
CriticalCVSS 10.0Summary
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.
Risk Assessment
The risk includes reading, modifying, or deleting data in notebooks, potentially leading to data confidentiality and integrity breaches.
Recommendation
It is recommended to immediately upgrade SiYuan to version v3.7.3 or later and implement input validation and parameterized SQL queries.
Original NVD description (English source)
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.