Vulnerabilities CVE-2026-69083

CVE-2026-69083

Critical

Open

TLP:CLEAR

SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.

Details

CVSS Score: 9.9
EPSS Score ⓘ: 0.35%

27.7th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Confidence: 90%
Published: Aug 3, 2026
Last Modified: Aug 3, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.