CVE-2026-69083
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
CVSS Score
10.0
EPSS Score
0.0%
EPSS Percentile
0th
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.
| CWE | CWE-89 |
| Vendor | siyuan-note |
| Product | siyuan |
| Published | Aug 3, 2026 |
| Last Updated | Aug 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for siyuan-note siyuan
Be the first to know when new critical vulnerabilities affecting siyuan-note siyuan are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
siyuan-note / siyuan
0 < 3.7.3
References
Credits
🔍 Shirshakhtml