# CVE-2026-69085: SiYuan unauthenticated SQL injection in searchDocs endpoint

Source: https://junglewise.ai/threats/cve-2026-69085-siyuan-unauthenticated-sql-injection-in-searchdocs-via-unescaped  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-09  
License: CC BY 4.0 with a link back

CVE-2026-69085 · Severity: low · CVSS 3.1 · Published 2026-10-07

SiYuan is a note-taking and knowledge management application. An unauthenticated attacker can inject SQL commands through the searchDocs endpoint when publish mode is enabled, allowing them to read and modify notes across all non-encrypted notebooks on the instance. The vulnerability requires no authentication, CSRF token, or write permissions.

Technologies: [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel), [SiYuan](https://junglewise.ai/threats/technologies/siyuan). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [SiYuan](https://junglewise.ai/threats/vendors/siyuan).

## Quick answers

**Is CVE-2026-69085 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69085 being exploited in the wild.

**How severe is CVE-2026-69085?** Low severity, with a CVSS score of 3.1, published 7 October 2026.

**Which products and versions are affected?** github.com/siyuan-note/siyuan/kernel (Go) SEMVER:introduced=0,fixed=0.0.0-20260721043339-eef10568384e; SiYuan <=v3.7.2.

**Is there a fix for CVE-2026-69085?** Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260721043339-eef10568384e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69085 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-69085?** Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260721043339-eef10568384e or later

  ```sh
  go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260721043339-eef10568384e
  ```


## Technical details

The /api/filetree/searchDocs endpoint concatenates unsanitized user input directly into SQL queries without escaping or parameter binding. The SQLite driver used executes stacked statements (separated by semicolons), enabling arbitrary SQL execution on a read-write database handle. The vulnerability affects all cleartext notebooks accessible through the global blocks table; encrypted notebooks are not exposed.

## Affected products

- SiYuan SiYuan <=v3.7.2

## Identifiers

- CVE-2026-69085
- GHSA-33jq-p8c2-q3q4
- GO-2026-6621

## Timeline

- 2026-07-20: disclosed
- 2026-07-20: patched: v3.7.3 released

## References

- [https://github.com/siyuan-note/siyuan/security/advisories/GHSA-33jq-p8c2-q3q4](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-33jq-p8c2-q3q4)

## Related threats

- [SiYuan path traversal in web fetch](https://junglewise.ai/threats/cve-2026-126776-siyuan-3-7-0-before-3-8-10-on-windows-contains-a-path-traversal)
- [SiYuan publish filter information disclosure in local storage](https://junglewise.ai/threats/go-2026-6836-siyuan-the-publish-filter-for-local-storage-returns-the-7f022e62)
- [SiYuan path traversal via GLOBALROOT alias bypass](https://junglewise.ai/threats/cve-2026-118680-siyuan-3-8-7-through-3-8-8-fails-to-normalize-windows-globalroot)
- [SiYuan SQL injection in history search](https://junglewise.ai/threats/cve-2026-116170-siyuan-before-v3-8-7-contains-an-sql-injection-vulnerability)
- [SiYuan cross-site scripting in /check-auth redirect](https://junglewise.ai/threats/cve-2026-116167-siyuan-from-2-9-0-before-3-8-7-contains-a-cross-site-scripting)