Critical SQL Injection Vulnerability Discovered in SiYuan Software

Feedly

Critical SQL Injection Vulnerability Discovered in SiYuan Software

First seen 3 Aug 2026, 19:17 UTC • •72.0

Article Content

1 / 8

Browse articles

ThreatCluster •August 4, 2026 at 18:13 UTC

•CVE-2026-69083 is a critical SQL injection vulnerability in SiYuan software.
•Unauthenticated users can exploit this flaw to execute arbitrary SQL commands.
•Immediate upgrade to SiYuan v3.7.3 is recommended to mitigate the risk.

A critical SQL injection vulnerability, designated CVE-2026-69083, has been identified in SiYuan versions prior to v3.7.3. This flaw affects the fullTextSearchAssetContent endpoint, allowing unauthenticated users and those with publish RoleReader tokens to execute arbitrary SQL commands. Attackers can manipulate unescaped method parameters and REGEXP clauses to read, modify, or delete data across notebooks in the asset-content database. Currently, there is no evidence of public exploitation or proof-of-concept code. Users are advised to upgrade to version 3.7.3 or later immediately. If upgrading is not feasible, restricting network access to the vulnerable endpoint and auditing access logs for suspicious activity is recommended. The vulnerability has been assigned a CVSS score of 4.0, indicating a high severity level.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 48d ago How this analysis works

Timeline

2026-08-03

CVE-2026-69083 published

The National Vulnerability Database published details of the SQL injection vulnerability affecting SiYuan versions before v3.7.3.

2026-08-03

Security advisory released

GitHub Advisories issued a security advisory regarding CVE-2026-69083, urging users to upgrade to the latest version.

2026-08-03

Critical risk assessment

CVE-2026-69083 has been rated as a critical risk, necessitating immediate intervention from affected users.

More articles in this cluster (7)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Sql Injection
T1190 - Exploit Public-Facing Application

Organization (1)

SiYuan

Vulnerability (1)

CVE-2026-69083

Weakness (1)

Cwe-89 - SQL Injection

Affected Platform (1)

SQLite

Relationships

CVE-2026-69083 targets SQLite
Sql Injection targets SQLite
T1190 - Exploit Public-Facing Application targets SQLite
CVE-2026-69083 related to SiYuan
CVE-2026-69083 related to Cwe-89 - SQL Injection

Following this threat?

Track SiYuan and CVE-2026-69083 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical WSO2 API Manager Vulnerability Under Active Exploitation A critical vulnerability (CVE-2026-5430) in WSO2 API Manager is being actively exploited, allowing unauthenticated attackers to forge admin tokens via JWT authentication bypass. This flaw, which has a CVSS score of 10.0, affects multiple WSO2 products including API Manager, Universal Gateway, Traffic Manager, and API…

Critical Linux Kernel Vulnerability CVE-2025-39682 Under Active Exploitation A critical vulnerability (CVE-2025-39682) in the Linux kernel allows remote code execution through mishandling of zero-length TLS records. This flaw affects kTLS-enabled hosts running vulnerable kernel versions, exposing them to attackers without authentication. CISA added this vulnerability to its Known Exploited…