High severity · published Sep 26, 2026
CVE-2026-100644
SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database rows from all notebooks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
siyuan · siyuan-note
before 3.8.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100644
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100644
vendor-advisory
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xr4h-j7cg-q8pc
third-party-advisory
https://www.vulncheck.com/advisories/siyuan-before-3.8.4-sql-injection-via-dailynotesavepath
More from siyuan
10.0
CVE-2026-72811
SiYuan before v3.7.4 SQL Injection via backlink search
10.0
CVE-2026-69085
SiYuan before v3.7.3 SQL Injection via searchDocs
10.0
CVE-2026-69084
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
10.0
CVE-2026-69083
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
10.0
CVE-2026-66012
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP