Critical SQL Injection Vulnerability Discovered in SiYuan Software

A critical SQL injection vulnerability, designated CVE-2026-69083, has been identified in SiYuan versions prior to v3.7.3. This flaw affects the fullTextSearchAssetContent endpoint, allowing unauthenticated users and those with publish RoleReader tokens to execute arbitrary SQL commands. Attackers can manipulate unescaped method parameters and REGEXP clauses to read, modify, or delete data across notebooks in the asset-content database. Currently, there is no evidence of public exploitation or proof-of-concept code. Users are advised to upgrade to version 3.7.3 or later immediately. If upgrading is not feasible, restricting network access to the vulnerable endpoint and auditing access logs for suspicious activity is recommended. The vulnerability has been assigned a CVSS score of 4.0, indicating a high severity level.

Key Points: • CVE-2026-69083 is a critical SQL injection vulnerability in SiYuan software. • Unauthenticated users can exploit this flaw to execute arbitrary SQL commands. • Immediate upgrade to SiYuan v3.7.3 is recommended to mitigate the risk.