Executive brief
SiYuan is a note-taking and knowledge management application used to organize and store personal data across notebooks. This vulnerability allows unauthenticated users and read-only published users to execute arbitrary SQL queries against the asset database, potentially exposing, modifying, or deleting sensitive notes and embedded content across multiple notebooks without requiring any login credentials or special permissions.
Technical details
The vulnerability exists in the /api/search/fullTextSearchAssetContent endpoint and comprises two distinct SQL injection flaws. Method 2 passes client-supplied SQL statements directly to the asset-content database without single-statement or read-only guards and lacks the admin-role checks present in the sibling fullTextSearchBlock endpoint. Method 3 constructs REGEXP clauses by concatenating user input without quote escaping, allowing SQL injection breakout (whereas the equivalent block-search builder properly escapes quotes). Both execute on a read-write database handle through a stacking-capable SQLite driver with cross-notebook scope. The endpoint's CheckAuth-only route protection allows unauthenticated users and publish RoleReader tokens to reach the vulnerable code. No patches are available as of the advisory publication, though version 3.7.3 is referenced as the fixed version in some references.
Affected products
- SiYuan SiYuan < 3.7.3
Timeline
- 2026-08-03: disclosed
- 2026-08-03: advisory
- 2026-09-03: other: Advisory withdrawn as duplicate of GHSA-fph3-ghq9-vw66