DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-72807: CVE-2026-72807: Second-Order SQL Injection via Attribute View Templates in SiYuan

#security #cve #cybersecurity

CVE-2026-72807: Second-Order SQL Injection via Attribute View Templates in SiYuan

Vulnerability ID: CVE-2026-72807
CVSS Score: 8.8
Published: 2026-09-03

CVE-2026-72807 is a second-order SQL injection vulnerability in SiYuan versions prior to v3.7.4. It resides in the dynamic evaluation of Attribute View (AV) template columns, which expose unsafe template functions. An attacker can exploit this by distributing a malicious SiYuan package that executes arbitrary SQL queries on the victim's local database.

TL;DR

Unauthenticated second-order SQL injection in SiYuan personal knowledge management system via malicious dynamic icon template rendering in Attribute Views.

Technical Details

  • CWE ID: CWE-89
  • Attack Vector: Network
  • CVSS v4.0 Score: 8.8 (High)
  • EPSS Score: 0.00199 (Percentile: 9.77%)
  • Exploit Status: No public PoC
  • CISA KEV Status: Not Listed
  • Impact: Arbitrary read/write database access

Affected Systems

  • SiYuan Personal Knowledge Management System
  • siyuan: < 3.7.4 (Fixed in: 3.7.4)

Mitigation Strategies

  • Upgrade SiYuan to version v3.7.4 or later immediately.
  • Inspect external .sy files and imported notebooks for dynamic Go templates containing SQL utility commands before importing.

Remediation Steps:

  1. Identify all active installations of SiYuan in the environment.
  2. Verify the version is lower than 3.7.4.
  3. Download and apply the patch for version 3.7.4 or later from official channels.
  4. Configure import policies to prevent untrusted personal knowledge management packages from executing automatically.

References

Read the full report for CVE-2026-72807 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)