DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-72811: CVE-2026-72811: Remote SQL Injection in SiYuan Backlink and Mention Search Engine

#security #cve #cybersecurity

CVE-2026-72811: Remote SQL Injection in SiYuan Backlink and Mention Search Engine

Vulnerability ID: CVE-2026-72811
CVSS Score: 10.0
Published: 2026-09-03

A critical SQL Injection vulnerability exists in the SiYuan note-taking application (versions <= v3.7.2) due to improper neutralization of single quotes within the backlink and mention search queries. Because the application constructs SQLite Full Text Search (FTS) queries via direct string concatenation and uses a database driver that supports stacked query statements, remote unauthenticated attackers can execute arbitrary SQL commands on the master database, compromising all hosted notebooks. This issue has been fully remediated in version v3.7.4.

TL;DR

Unauthenticated remote SQL injection via unescaped string concatenation in SiYuan's SQLite FTS backlink query engine, remediated in v3.7.4.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command)
  • Attack Vector: Network (Unauthenticated, Remote)
  • CVSS v3.1 Score: 10.0 (Critical)
  • EPSS Score: 0.0025 (Percentile: 16.27%)
  • Impact: Arbitrary Database Read/Write and System Configuration Alteration
  • Exploit Status: Proof-of-Concept (PoC) documented in research
  • KEV Status: Not Listed in CISA Known Exploited Vulnerabilities

Affected Systems

  • SiYuan Note-Taking Application
  • SiYuan: <= v3.7.2 (Fixed in: v3.7.4)

Code Analysis

Commit: 1a5b343

🔒 Parameterize backlink mention search https://github.com/siyuan-note/siyuan/security/advisories/GHSA-q2vg-7qgx-x5fc

Mitigation Strategies

  • Transition all dynamic string-concatenated SQLite queries to safe parameterized SQL queries using placeholders.
  • Implement strong input validation and strictly escape all single-quote characters targeting database search functions.
  • Disable SiYuan Publish Mode on untrusted public networks when immediate upgrades are not possible.
  • Enforce network-level restrictions using firewalls, reverse proxies, and VPNs to restrict backend search access to authorized clients.

Remediation Steps:

  1. Identify active installations running SiYuan version 3.7.2 or lower.
  2. Download and install SiYuan version 3.7.4 or newer from the official release repository.
  3. Verify the application has successfully updated by querying the current version in the settings dashboard.
  4. Verify that custom parameterized queries are active by auditing backlink search patterns in database access logs.

References

Read the full report for CVE-2026-72811 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)