Security readout for executives and security teams
Plain-English summary
SiYuan versions before 3.7.3 can allow a remote attacker to access or alter information in cleartext notebooks through a vulnerable document-search function. Exposure may require a publish RoleReader token, but no authentication is needed when publish mode disables authentication. Encrypted notebooks are not identified as affected.
Executive priority
Prioritize immediate remediation for internet-accessible or unauthenticated publish deployments. The vulnerability can expose and alter business knowledge stored in cleartext notebooks, although the supplied evidence does not indicate availability impact or confirmed attacks. Restrict access immediately if upgrading cannot occur promptly.
Technical view
The /api/filetree/searchDocs endpoint inserts the keyword parameter directly into SQL without escaping or parameter binding. Its SQLite driver accepts stacked statements, and execution uses a read-write database handle. This creates network-reachable SQL injection capable of reading and modifying database content across cleartext notebooks.
Likely exposure
Instances running SiYuan before 3.7.3 are exposed when the endpoint is reachable using a publish RoleReader token. Risk is greater when publish mode is enabled and Publish.Auth.Enable is false, because the endpoint becomes unauthenticated. The supplied sources do not establish whether default installations expose this configuration.
Exploitation context
The CVSS 3.1 score is 10.0, reflecting remote, low-complexity exploitation without user interaction and potentially without privileges. The source bundle marks this CVE as absent from KEV and provides no evidence of active exploitation. Treat it as highly exploitable based on design, not confirmed exploitation in the wild.
Researcher notes
CWE-89 applies. The risk extends beyond data disclosure because the vulnerable query runs through a stacked-statement-capable driver on a read-write SQLite handle. Scope is described as all cleartext notebooks on the instance. Validate configuration and version safely; the supplied evidence does not describe compromise indicators or confirm exploitation activity.
Mitigation direction
- Upgrade SiYuan to version 3.7.3 or later.
- Until upgraded, disable unauthenticated publish mode and require publish authentication.
- Restrict network access to the affected endpoint and trusted users.
- Review the vendor advisory for any additional release-specific instructions.
Validation and detection
- Inventory SiYuan instances and confirm their installed versions.
- Identify instances with publish mode enabled and Publish.Auth.Enable set to false.
- Confirm access to searchDocs requires the intended RoleReader token after mitigation.
- Review application and database logs for unusual searchDocs activity or unexplained notebook changes.
- Verify cleartext notebook integrity using trusted backups or known-good records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-69085 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N3.95.8VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.9CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Base CVSS 3.1 score
10CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-33jq-p8c2-q3q4)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: SiYuan before v3.7.3 SQL Injection via searchDocsCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.