Back exploit-intel.com

CVE-2026-69083: SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent [CRITICAL] Exploit Intelligence — CVEs with Exploits / 12h This exploit demonstrates an unauthenticated SQL injection vulnerability (CVE-2026-69083) in SiYuan < 3.7.3 via the `/api/search/fullTextSearchAssetContent` endpoint. SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens.

exploit-intel.com • August 4, 2026

AI-analyzed exploit summary This exploit demonstrates an unauthenticated SQL injection vulnerability (CVE-2026-69083) in SiYuan < 3.7.3 via the `/api/ /fullTextSearchAssetContent` endpoint. The PoC exploits improper string concatenation in a REGEXP clause to dump the asset-content SQLite database, enabling data exfiltration.

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.

This exploit demonstrates an unauthenticated SQL injection vulnerability (CVE-2026-69083) in SiYuan < 3.7.3 via the `/api/ /fullTextSearchAssetContent` endpoint. The PoC exploits improper string concatenation in a REGEXP clause to dump the asset-content SQLite database, enabling data exfiltration.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerability Discovered in SiYuan Software A critical SQL injection vulnerability, designated CVE-2026-69083, has been identified in SiYuan versions prior to v3.7.3. This flaw affects the fullTextSearchAssetContent endpoint, allowing unauthenticated users and those with publish RoleReader tokens to execute arbitrary SQL commands. Attackers can manipulate unescaped method parameters and REGEXP clauses to read, modify, or delete data across notebooks in the asset-content database. Currently, there is no evidence of public exploitation or proof-of-concept code. Users are advised to upgrade to version 3.7.3 or later immediately. If upgrading is not feasible, restricting network access to the vulnerable endpoint and auditing access logs for suspicious activity is recommended. The vulnerability has been assigned a CVSS score of 4.0, indicating a high severity level. 4 sources 72

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)