{"id":"EUVD-2026-52278","enisaUuid":"db1b1a30-6e6f-36c4-a37d-a8b2adb1ce0b","description":"SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.","datePublished":"Aug 3, 2026, 1:20:40 PM","dateUpdated":"Aug 14, 2026, 4:51:12 PM","baseScore":9.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-33jq-p8c2-q3q4\nhttps://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-searchdocs\n","aliases":"CVE-2026-69085\nGHSA-5w4j-hchp-r332\n","assigner":"VulnCheck","epss":1.39,"enisaIdProduct":[{"id":"ab1fd4ef-8962-3c61-8cf3-adb0a6ea3d93","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"0 \u003c3.7.3"}],"enisaIdVendor":[{"id":"183f9b42-9e97-3075-b62e-912e0bdb017b","vendor":{"name":"siyuan-note"}}],"enisaIdVulnerability":[{"id":"e57121e2-fbbb-363f-9cce-67601f3893a9","vulnerability":{"id":"GHSA-5w4j-hchp-r332","description":"Duplicate Advisory: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking","datePublished":"Aug 3, 2026, 3:32:48 PM","dateUpdated":"Oct 1, 2026, 3:44:00 PM","baseScore":0.0,"references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-33jq-p8c2-q3q4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-69085\nhttps://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-searchdocs\n","enisa_id":"EUVD-2026-52278\n","aliases":"GHSA-5w4j-hchp-r332\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:51:03 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"efa2fbeb-0991-3320-b75d-feed494d880a","vulnerability":{"id":"CVE-2026-69085","description":"SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.","datePublished":"Aug 3, 2026, 1:20:40 PM","dateUpdated":"Aug 14, 2026, 4:51:12 PM","status":"PUBLISHED","baseScore":9.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-33jq-p8c2-q3q4\nhttps://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-searchdocs\n","enisa_id":"EUVD-2026-52278\n","assigner":"VulnCheck","epss":1.39,"dataProcessed":"Nov 11, 2026, 7:21:36 AM","vulnerabilityProduct":[{"id":"1cb6538e-fff0-3962-a237-8ca3b6daea82","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"0 \u003c3.7.3"}],"vulnerabilityVendor":[{"id":"e9f0c7d1-4bb7-3492-9b26-269fee65a21d","vendor":{"name":"siyuan-note"}}]}}],"enisaIdAdvisory":[]}