Live › vulnerability › CVE-2026-69085
Go to dashboardSiYuan's kernel has an SQL injection in the /api/filetree/searchDocs endpoint: the keyword parameter is concatenated into SQL without escaping. An attacker can read and modify the database for every unencrypted notebook on the instance, and can do so without logging in when publish mode is on with Publish.Auth.Enable set to false.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/siyuan-note/siyuan/kernel | go | < 0.0.0-20260721043339-eef10568384e | 0.0.0-20260721043339-eef10568384e |
v3.7.3 or later (kernel pseudo-version 0.0.0-20260721043339-eef10568384e or newer)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.
This page as .md · .json · in your agent: get_signal("CVE-2026-69085")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.