CVE-2026-69083: Critical unauthenticated SQL injection in SiYuan

How to Detect It

Detection should focus on two things: access to the fullTextSearchAssetContent endpoint and anomalous request parameters that suggest search input is being used to manipulate SQL or REGEXP behavior. Because the public technical detail is limited, defenders should avoid overly narrow signatures and instead combine endpoint monitoring, unusual parameter patterns, and data integrity checks for unexpected changes across notebooks.

Start by reviewing reverse proxy, application, and web server logs for requests hitting paths that map to fullTextSearchAssetContent, especially from unauthenticated sessions or external IPs. Look for spikes in requests, repetitive probing, and inputs containing SQL metacharacters such as single quotes, comment markers, boolean operators, or REGEXP-related payload fragments. Also audit for unexpected content modification or deletion events following such requests, since successful exploitation can alter stored data.

If SiYuan is behind Nginx, Apache, or another gateway, those logs may be your best immediate telemetry source. If direct application logs are sparse, pair web logs with file integrity monitoring, database write activity, or notebook content change history where available. In the absence of vendor-provided IOCs, defenders should assume exploit attempts may resemble generic SQLi probing against a search endpoint.

Technical Notes

Example grep pattern for suspicious requests in web logs:

grep -Ei "fullTextSearchAssetContent|regexp|union|select|--|/\*|\bor\b.+=|'" /var/log/nginx/access.log

Example Nginx access log filter for requests targeting the endpoint:

awk '$7 ~ /fullTextSearchAssetContent/ {print}' /var/log/nginx/access.log

Example Splunk search:

index=web sourcetype=nginx_access
("fullTextSearchAssetContent" OR "fulltextsearchassetcontent")
| eval suspicious=if(match(_raw, "(?i)(regexp|union|select|--|/\\*|\\bor\\b\s+1=1|')"), 1, 0)
| stats count values(status) values(clientip) by uri, suspicious
| sort - count

Example Sigma-style logic concept:

title: Possible SiYuan fullTextSearchAssetContent SQLi Probing
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-query|contains: "fullTextSearchAssetContent"
  selection_payload:
    cs-uri-query|contains:
      - "REGEXP"
      - "UNION"
      - "SELECT"
      - "--"
      - "/*"
      - "'"
  condition: selection_endpoint and selection_payload
level: high

These patterns are heuristic, not vendor-authored signatures. Tune them to your logging schema and be prepared for both false positives and missed low-noise exploitation.

Mitigation and Patching

The primary remediation is to upgrade SiYuan to version 3.7.3 or later. Based on the available references, all versions before 3.7.3 are affected, and 3.7.3 is the first fixed version. If you are operating an exposed or shared deployment, patching should take priority over cosmetic hardening because the flaw affects a read-write database and can result in destructive changes.

If immediate patching is not possible, reduce exposure aggressively. Restrict access to SiYuan behind a VPN, IP allowlist, or authenticated reverse proxy. Review whether publish features and RoleReader tokens are enabled or exposed, and disable public sharing if business requirements allow. Rotate or revoke exposed publish tokens where possible, because the documented exposure condition specifically mentions publish RoleReader tokens.

You should also assume potential data integrity impact on vulnerable systems. Before upgrading, back up notebooks and any relevant application data stores. After upgrading, review recent access logs and content history for signs of unauthorized reads, modifications, or deletions. If you find suspicious activity, treat the system as compromised at the application-data layer and preserve logs before cleanup.

Technical Notes

Example container upgrade workflow:

# Pull a fixed image tag if your deployment uses container images
docker pull siyuan-note/siyuan:3.7.3

# Recreate the container with the fixed version
docker stop siyuan
docker rm siyuan
docker run -d --name siyuan \
  -p 6806:6806 \
  -v /srv/siyuan/data:/siyuan/workspace \
  siyuan-note/siyuan:3.7.3

Example compose update pattern:

# Update the image tag in docker-compose.yml to 3.7.3 or later, then redeploy
docker compose pull
docker compose up -d

Example temporary Nginx restriction if you cannot patch immediately:

location / {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://127.0.0.1:6806;
}

Example emergency block for the likely vulnerable endpoint path, if you have confirmed it at your gateway layer:

location ~* fullTextSearchAssetContent {
    deny all;
    return 403;
}

These workarounds are risk-reduction steps, not substitutes for upgrading. Because the issue involves unsafe SQL handling, the correct long-term fix is to run SiYuan 3.7.3 or later.

References

The primary authoritative reference is the NVD entry for CVE-2026-69083, which states that SiYuan versions before 3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint and that exploitation can allow arbitrary SQL execution against the read-write asset-content database. That is the clearest public source for severity, affected range, and impact.

The upstream project advisory path on GitHub is also important because it ties the issue directly to the siyuan-note/siyuan project. A third corroborating source, VulnCheck, aligns with the same affected version boundary and endpoint naming. Finally, CISA KEV is useful for exploitation tracking and currently does not list this CVE.

• NVD CVE entry: https://nvd.nist.gov/vuln/detail/CVE-2026-69083
• GitHub security advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fph3-ghq9-vw66
• Project repository: https://github.com/siyuan-note/siyuan
• VulnCheck advisory: https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-fulltextsearchassetcontent
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

For incident response and exposure review, defenders should use the references above to confirm product versions, compare deployment paths, and watch for any later updates about exploitation, additional indicators, or revised vendor guidance. If new PoCs or exploitation evidence emerge, detection logic and patch urgency should be revisited immediately, but the current evidence already supports urgent remediation.

For further understanding of related vulnerabilities, you can check the CVE-2026-17561 and what is DDoS articles.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.