{"uuid": "03e27d68-c580-4a42-96b2-3e7c02490ac8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-fph3-ghq9-vw66", "type": "seen", "source": "https://gist.github.com/alon710/c2ca54e4a5685bbc943777487cd106b5", "content": "# CVE-2026-69083: CVE-2026-69083: Unauthenticated SQL Injection and SQL Command Execution in SiYuan Full-Text Search API\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69083\n\n## Summary\nAn unauthenticated SQL injection and SQL execution vulnerability in SiYuan allows remote attackers to compromise the integrity and confidentiality of the asset database. The flaw exists due to string concatenation in regular expression searches and a complete lack of authorization checks on raw SQL querying pathways under default configurations. Attackers can leverage this vulnerability to exfiltrate database contents, manipulate index records, or access cross-notebook contents without any valid credentials.\n\n## TL;DR\nUnauthenticated remote attackers can execute arbitrary SQL commands on SiYuan's SQLite database via the full-text search endpoint, resulting in complete exposure or modification of indexed documents and application metadata.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 10.0 (Critical)\n- **EPSS Score**: 0.0035 (27.97th percentile)\n- **Exploit Status**: Functional PoC Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **SiYuan**: < 3.7.3 (Fixed in: `3.7.3`)\n\n## Mitigation\n\n- Upgrade the SiYuan application to version 3.7.3 or above\n- Enforce a strong, non-empty access authentication code using the accessAuthCode configuration parameter\n- Deploy Web Application Firewall rules to block unauthorized database command sequences targeting the search API\n\n**Remediation Steps:**\n1. Identify and document all active deployments of the SiYuan application within the corporate network\n2. Update container images and local binary instances of SiYuan to version 3.7.3 or higher\n3. Review and verify configuration files to ensure the accessAuthCode parameter is set to a complex passphrase\n4. Implement perimeter filtering rules on port 6806 to restrict exposure of the web interface to trusted network zones\n\n## References\n\n- [GitHub Security Advisory GHSA-fph3-ghq9-vw66](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fph3-ghq9-vw66)\n- [Functional Proof-of-Concept Exploit on GitHub](https://github.com/0xdak/CVE-2026-69083_exploit)\n- [VulnCheck Vulnerability Advisory](https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-fulltextsearchassetcontent)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69083) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T16:32:20.457261Z"}