CVE-2026-69083 National Vulnerability Database / 9h SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.

nvd.nist.gov • August 4, 2026

This CVE record has recently been published to the CVE List and has been included within the NVD dataset.

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerability Discovered in SiYuan Software A critical SQL injection vulnerability, designated CVE-2026-69083, has been identified in SiYuan versions prior to v3.7.3. This flaw affects the fullTextSearchAssetContent endpoint, allowing unauthenticated users and those with publish RoleReader tokens to execute arbitrary SQL commands. Attackers can manipulate unescaped method parameters and REGEXP clauses to read, modify, or delete data across notebooks in the asset-content database. Currently, there is no evidence of public exploitation or proof-of-concept code. Users are advised to upgrade to version 3.7.3 or later immediately. If upgrading is not feasible, restricting network access to the vulnerable endpoint and auditing access logs for suspicious activity is recommended. The vulnerability has been assigned a CVSS score of 4.0, indicating a high severity level. 4 sources 72

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)