Executive brief
SiYuan is a note-taking application that stores content in a local SQLite database. Versions through 3.7.2 fail to properly restrict access to a search API endpoint that accepts raw SQL queries, allowing unauthenticated users (including readers of published content) to execute arbitrary database operations. An attacker can read sensitive notes and modify or delete content across all unencrypted notebooks without any legitimate access rights.
Technical details
The vulnerability is a SQL injection / unsafe API design flaw in the /api/search/searchEmbedBlock endpoint. The endpoint accepts a "stmt" parameter containing a raw SQL statement and passes it verbatim to SearchEmbedBlock → SearchEmbedBlockInBox → sql.SelectBlocksRawStmtNoParse → query(), which executes the statement on the global read-write siyuan.db handle via the mattn/go-sqlite3 driver. The endpoint is gated only by CheckAuth, making it reachable by publish-mode RoleReader tokens and anonymous users when publish.auth.enable is false. Unlike the guarded /api/query/sql endpoint, searchEmbedBlock lacks CheckSingleStatement, CheckReadonlyStatement, or CheckAdminRole guards. The underlying driver supports stacked statements (separated by semicolons), permitting side effects before post-hoc FilterEmbedBlocksByPublishAccess filtering runs. An unauthenticated attacker can therefore read and write content across all cleartext (unencrypted) notebooks and exploit ATTACH to access filesystem resources. Encrypted per-box notebooks are isolated and excluded. The fix in v3.7.3 applies proper access controls and statement validation.
Affected products
- SiYuan SiYuan <= 3.7.2
Timeline
- 2026-07-21: disclosed: Original advisory GHSA-vh22-h7hf-www7 published
- 2026-08-03: advisory: Duplicate advisory GHSA-p2x7-4c4p-8wh6 published; CVE-2026-69084 assigned
- 2026: patched: Fixed in v3.7.3