CVE-2026-69085

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3

Description A SQL injection issue exists in the '/api/filetree/searchDocs' endpoint. The keyword parameter is concatenated directly into SQL statements without escaping or parameter binding. This endpoint is accessible via a publish RoleReader token or without authentication if publish mode is active and Publish.Auth.Enable is set to false. Since the system uses a read-write SQLite handle that supports stacked statements (multiple SQL commands separated by semicolons), an attacker can read and modify database content across all non-encrypted notebooks on the instance.

Recommendations Update SiYuan to version 3.7.3 or later. As a temporary mitigation, avoid using the keyword parameter in the '/api/filetree/searchDocs' endpoint or restrict access to this endpoint.