CVE-2026-69085: SQL injection in searchDocs

CISO Take

SiYuan, a self-hosted note-taking and knowledge-management tool with built-in AI chat features, has a critical SQL injection in its /api/filetree/searchDocs endpoint (CVSS 10.0) where the search keyword is concatenated directly into SQL with no parameter binding, and because the underlying SQLite driver supports stacked statements, an attacker can both read and write data across every unencrypted notebook. The endpoint is reachable with only a low-privilege RoleReader publish token, or with no authentication at all if an instance runs in Publish mode with Publish.Auth.Enable set to false — a configuration mistake that's easy to make on self-hosted deployments exposed to the internet. Real-world urgency is currently moderate rather than acute: it isn't in CISA KEV, no public exploit or Nuclei template exists, and its EPSS score (0.25%, 83rd percentile) sits well within typical low-severity exploitation likelihood despite the maximum CVSS score — CISA's SSVC decision is ATTEND, not immediate action. For teams running SiYuan as a personal or team knowledge base — including as context for its AI assistant features — the practical risk is that pasted credentials, API keys, or proprietary notes sit fully exposed to anyone who can reach a misconfigured publish instance. Patch to v3.7.3 or later immediately, and in the meantime verify Publish.Auth.Enable is true and that publish endpoints aren't reachable from the open internet without a firewall allowlist.

Sources: NVD GitHub Advisory EPSS ATLAS VulnCheck

What is the risk?

Technically the risk is severe: network-reachable, no user interaction, low complexity, and in the unauthenticated-publish-mode configuration, no privileges required at all — hence the maximum CVSS score. However, real-world exploitation pressure is currently low: no CISA KEV listing, no public PoC, no Nuclei template, and an EPSS score of only 0.25% (though 83rd percentile relative to the broader CVE population, reflecting how few CVEs get exploited at all). CISA's SSVC decision of ATTEND (not ACT) reflects this gap between theoretical severity and observed exploitation. The realistic risk profile is 'trivial to exploit if discovered, but requires an attacker to specifically target exposed SiYuan publish instances' — a real but not currently mass-exploited threat.

How does the attack unfold?

Discovery

Attacker identifies an internet-exposed SiYuan instance running in Publish mode and checks whether Publish.Auth.Enable is disabled or obtains a low-privilege RoleReader token.

AML.T0006

Exploitation

Attacker sends a crafted keyword parameter with a stacked SQL payload to /api/filetree/searchDocs, which is concatenated unescaped into the backend SQL statement.

AML.T0049

Impact — data exfiltration and tampering

The injected statements execute on the read-write SQLite handle, letting the attacker read or modify content across all cleartext notebooks, including any credentials or sensitive notes stored there.

AML.T0036

Discovery

Attacker identifies an internet-exposed SiYuan instance running in Publish mode and checks whether Publish.Auth.Enable is disabled or obtains a low-privilege RoleReader token.

AML.T0006

Exploitation

Attacker sends a crafted keyword parameter with a stacked SQL payload to /api/filetree/searchDocs, which is concatenated unescaped into the backend SQL statement.

AML.T0049

Impact — data exfiltration and tampering

The injected statements execute on the read-write SQLite handle, letting the attacker read or modify content across all cleartext notebooks, including any credentials or sensitive notes stored there.

AML.T0036

How severe is it?

CVSS 3.1

10.0 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Changed

C High

I High

A None

What should I do?

1 step

Upgrade to SiYuan v3.7.3 or later immediately — this is the primary fix since the vulnerability is a missing-parameterization bug in the search handler itself. Until patched, ensure Publish.Auth.Enable is set to true so publish-mode instances require an authenticated RoleReader token rather than being open to anyone. Restrict network exposure of publish endpoints via firewall/reverse-proxy allowlisting rather than exposing them directly to the internet. Move sensitive notebooks into SiYuan's encryption feature, since encrypted notebooks are explicitly outside this vulnerability's blast radius. For detection, monitor reverse-proxy/WAF logs for requests to /api/filetree/searchDocs containing SQL metacharacters (semicolons, quotes, SQL keywords) in the keyword parameter, and rotate any credentials that may have been stored in plaintext notes on an internet-exposed instance.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Auth Bypass Privacy Violation RAG API AML.T0025 - Exfiltration via Cyber Means AML.T0036 - Data from Information Repositories AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.7.2 - Data quality and security for AI systems

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-69085?

SiYuan, a self-hosted note-taking and knowledge-management tool with built-in AI chat features, has a critical SQL injection in its /api/filetree/searchDocs endpoint (CVSS 10.0) where the search keyword is concatenated directly into SQL with no parameter binding, and because the underlying SQLite driver supports stacked statements, an attacker can both read and write data across every unencrypted notebook. The endpoint is reachable with only a low-privilege RoleReader publish token, or with no authentication at all if an instance runs in Publish mode with Publish.Auth.Enable set to false — a configuration mistake that's easy to make on self-hosted deployments exposed to the internet. Real-world urgency is currently moderate rather than acute: it isn't in CISA KEV, no public exploit or Nuclei template exists, and its EPSS score (0.25%, 83rd percentile) sits well within typical low-severity exploitation likelihood despite the maximum CVSS score — CISA's SSVC decision is ATTEND, not immediate action. For teams running SiYuan as a personal or team knowledge base — including as context for its AI assistant features — the practical risk is that pasted credentials, API keys, or proprietary notes sit fully exposed to anyone who can reach a misconfigured publish instance. Patch to v3.7.3 or later immediately, and in the meantime verify Publish.Auth.Enable is true and that publish endpoints aren't reachable from the open internet without a firewall allowlist.

Is CVE-2026-69085 actively exploited?

No confirmed active exploitation of CVE-2026-69085 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-69085?

Upgrade to SiYuan v3.7.3 or later immediately — this is the primary fix since the vulnerability is a missing-parameterization bug in the search handler itself. Until patched, ensure Publish.Auth.Enable is set to true so publish-mode instances require an authenticated RoleReader token rather than being open to anyone. Restrict network exposure of publish endpoints via firewall/reverse-proxy allowlisting rather than exposing them directly to the internet. Move sensitive notebooks into SiYuan's encryption feature, since encrypted notebooks are explicitly outside this vulnerability's blast radius. For detection, monitor reverse-proxy/WAF logs for requests to /api/filetree/searchDocs containing SQL metacharacters (semicolons, quotes, SQL keywords) in the keyword parameter, and rotate any credentials that may have been stored in plaintext notes on an internet-exposed instance.

What systems are affected by CVE-2026-69085?

This vulnerability affects the following AI/ML architecture patterns: Personal/team knowledge management (RAG-adjacent note stores), Self-hosted AI-assisted note-taking apps, Publicly published wiki/API deployments.

What is the CVSS score for CVE-2026-69085?

CVE-2026-69085 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 0.25%.

What is the AI security impact?

Affected AI Architectures

Personal/team knowledge management (RAG-adjacent note stores)Self-hosted AI-assisted note-taking appsPublicly published wiki/API deployments

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0036 Data from Information Repositories

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.7.2

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.

Exploitation Scenario

An attacker scans for internet-exposed SiYuan instances running in Publish mode (a common pattern for sharing personal wikis or team knowledge bases publicly). Finding one with Publish.Auth.Enable set to false — or simply holding a low-privilege RoleReader token — the attacker sends a crafted 'keyword' value to /api/filetree/searchDocs containing a stacked SQL payload (e.g., a search term followed by a semicolon and additional SELECT/UPDATE statements). Because the parameter is concatenated unescaped into the query and the SQLite driver executes stacked statements on a read-write handle, the injected SQL runs with full database privileges: the attacker first dumps all non-encrypted notebook content (harvesting any pasted credentials, API keys, or sensitive notes), then optionally issues UPDATE/INSERT statements to tamper with stored notes or plant misleading content that could later surface through SiYuan's AI assistant.

Weaknesses (CWE)

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, consider using persistence layers such as Hibernate or Enterprise Java Beans, which can provide significant protection against SQL injection if used properly.
[Architecture and Design] If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated. Process SQL queries using prepared statements, parameterized queries, or stored procedures. These features should accept parameters or variables and support strong typing. Do not dynamically construct and execute query strings within these features using "exec" or similar functionality, since this may re-introduce the possibility of SQL injection. [REF-867]

Source: MITRE CWE corpus.