DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-69083: CVE-2026-69083: Unauthenticated SQL Injection and SQL Command Execution in SiYuan Full-Text Search API

#security #cve #cybersecurity

CVE-2026-69083: Unauthenticated SQL Injection and SQL Command Execution in SiYuan Full-Text Search API

Vulnerability ID: CVE-2026-69083
CVSS Score: 10.0
Published: 2026-09-03

An unauthenticated SQL injection and SQL execution vulnerability in SiYuan allows remote attackers to compromise the integrity and confidentiality of the asset database. The flaw exists due to string concatenation in regular expression searches and a complete lack of authorization checks on raw SQL querying pathways under default configurations. Attackers can leverage this vulnerability to exfiltrate database contents, manipulate index records, or access cross-notebook contents without any valid credentials.

TL;DR

Unauthenticated remote attackers can execute arbitrary SQL commands on SiYuan's SQLite database via the full-text search endpoint, resulting in complete exposure or modification of indexed documents and application metadata.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-89
  • Attack Vector: Network (AV:N)
  • CVSS Score: 10.0 (Critical)
  • EPSS Score: 0.0035 (27.97th percentile)
  • Exploit Status: Functional PoC Available
  • CISA KEV Status: Not Listed

Affected Systems

  • SiYuan Personal Knowledge Management System
  • SiYuan: < 3.7.3 (Fixed in: 3.7.3)

Code Analysis

Commit: cf42dd5

Parameterize full-text search database query execution and enforce admin authorization check on raw SQL statements.

Exploit Details

  • GitHub: Functional proof-of-concept Python script to exfiltrate SQLite indexed asset database records

Mitigation Strategies

  • Upgrade the SiYuan application to version 3.7.3 or above
  • Enforce a strong, non-empty access authentication code using the accessAuthCode configuration parameter
  • Deploy Web Application Firewall rules to block unauthorized database command sequences targeting the search API

Remediation Steps:

  1. Identify and document all active deployments of the SiYuan application within the corporate network
  2. Update container images and local binary instances of SiYuan to version 3.7.3 or higher
  3. Review and verify configuration files to ensure the accessAuthCode parameter is set to a complex passphrase
  4. Implement perimeter filtering rules on port 6806 to restrict exposure of the web interface to trusted network zones

References

Read the full report for CVE-2026-69083 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)