SiYuan has a security flaw

Published September 3, 2026 CVE-2026-69083

SiYuan is a personal note-taking app. Attackers can read, change, or delete your notes without logging in, by abusing a bug in its built-in search feature.

Severity
CriticalCVSS 3.1 · 10.0
Fix
Fixed in 0.0.0-20260721004815-cf42dd5680c8Fix recorded on Aug 26, 2026
Affected versions
before 0.0.0-20260721004815-cf42dd5680c8
Weakness
CWE-89SQL Injection
Exploit likelihood
0.35% in 30 daysEPSS, higher than 28% of known flaws
Affects
SiYuan

How it works

SiYuan's feature that searches inside uploaded files does not clean up the search text it receives, so an attacker can hide database commands inside that text, and the app runs them directly against its notes database, no password needed.

What to do

Open SiYuan's About screen or check the version shown in the app, and compare it against the v3.7.3 release on the project's GitHub releases page. If your installed version is older than v3.7.3, or your server is reachable from the internet, you are exposed.

Update SiYuan to version 3.7.3 or later through the app's built-in updater or the official GitHub releases page, and until you update, do not expose your SiYuan server directly to the internet.

Technical details

The flaw is a SQL injection (CWE-89) in the fullTextSearchAssetContent API endpoint. Method parameters and REGEXP clause values are inserted into SQL queries without escaping, letting an attacker run arbitrary SQL against SiYuan's read-write asset-content database. The endpoint is reachable both by fully unauthenticated requests and by RoleReader-level publish tokens, which are meant only to let someone view a published notebook, not query the database. CVSS is 10.0, critical, reflecting unauthenticated read, modification, and deletion of data across notebooks.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Open in FIRST.org calculator

References

View Original Source