Critical severity · published Aug 3, 2026
CVE-2026-69083
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
10.0
CVSS
0.5%
EPSS
No
On KEV
Description
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
siyuan · siyuan-note
before 3.7.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-69083
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-69083
github.com
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fph3-ghq9-vw66
www.vulncheck.com
https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-fulltextsearchassetcontent
More from siyuan
10.0
CVE-2026-72811
SiYuan before v3.7.4 SQL Injection via backlink search
10.0
CVE-2026-69085
SiYuan before v3.7.3 SQL Injection via searchDocs
10.0
CVE-2026-69084
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
10.0
CVE-2026-66012
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP
9.9
CVE-2026-50551
SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content