CVE-2026-69084

Executive Summary

CVE-2026-69084 is a critical pre-authentication SQL injection vulnerability in SiYuan note-taking software, affecting all versions up to and including v3.7.2. The /api/search/searchEmbedBlock endpoint passes client-controlled SQL statements directly to the main read-write siyuan.db SQLite handle without sanitization, single-statement enforcement, or privilege checks. Because the endpoint is gated only by CheckAuth — which permits the publish RoleReader token and anonymous access when publish authentication is disabled — any network-reachable user can execute stacked SQL queries to read and modify all cleartext notebook data. The vulnerability carries a CVSS score of 10.0 (Critical) with a scope change, reflecting full confidentiality and integrity impact across the entire application. SiYuan v3.7.3 addresses the flaw; no patch source is formally tracked, and no CISA KEV listing exists at the time of writing.

Technical Analysis

Vulnerability Mechanism

The root cause resides in SiYuan's search embed block functionality. The endpoint /api/search/searchEmbedBlock accepts a POST request containing a JSON payload with a user-supplied stmt (SQL statement) field. The application passes this stmt value verbatim to a function that executes it against the application's main SQLite database handle, siyuan.db.

The critical weaknesses are:

1. No input sanitization: The stmt field is not parameterized, escaped, or validated against an allowlist of permitted queries.
2. No statement-type restriction: The underlying database driver (SQLite via database/sql in Go or a similar binding) supports stacked queries — i.e., multiple semicolon-terminated statements in a single execution string. This allows an attacker to append ; DROP TABLE ..., INSERT, UPDATE, or SELECT statements to the legitimate search query.
3. Incorrect authorization gate: The endpoint is protected solely by CheckAuth(). This function validates either a user session or a publish RoleReader token. When publish authentication is disabled (a common deployment configuration for public notebooks), CheckAuth() returns success for anonymous requests. No administrator role check, no read-only flag, and no per-notebook permission check is applied to the SQL execution context.
4. Read-write database handle: The vulnerable endpoint uses the same DB handle used by the application's main write path. This means the executed SQL operates with full INSERT, UPDATE, DELETE, CREATE, and DROP privileges on the SQLite file. There is no separate read-only replica or prepared-statement-only handle.

Attack Surface

• Network-exposed SiYuan instances: Any SiYuan deployment reachable over HTTP/HTTPS (default ports 6806 or 6807, or reverse-proxied) is exposed.
• Publish-enabled notebooks: The RoleReader token is issued to share notebooks publicly. If an attacker obtains this token (often embedded in public share links) or if publish authentication is disabled, the endpoint is reachable without any session.
• Data at risk: All notebooks opened in the workspace are stored in cleartext within siyuan.db. Encrypted per-box notebooks (using E2E encryption) are excluded because their content is stored as ciphertext; however, the SQL injection can still modify notebook metadata, tags, and document structure for those boxes.

Code-Level Explanation (Reconstructed)

The vulnerable call chain resembles:

POST /api/search/searchEmbedBlock
  -> handler: func searchEmbedBlock(ctx *gin.Context)
  -> auth: CheckAuth(ctx) // passes if reader token or anonymous publish
  -> sqlStmt := ctx.PostForm("stmt") // no validation
  -> db.Exec(sqlStmt) // stacked queries allowed

No LIMIT 1, no PRAGMA query_only, no transaction wrapping, and no regex pattern matching of the SQL string were observed. The fix in v3.7.3 likely introduces a statement allowlist, wraps execution in a read-only transaction, or switches to a dedicated read-only DB handle.

Exploitation Scenarios

Scenario 1: Anonymous Exfiltration (Publish Auth Disabled)

1. Reconnaissance: Attacker identifies SiYuan instances via Shodan dorks (http.title:"SiYuan", http.html:"siyuan").
2. Probe: Send POST /api/search/searchEmbedBlock with payload {"stmt":"SELECT 1"}. A response containing {"code":0} or a truthy result confirms the endpoint is live.
3. Data Exfiltration: Submit stacked query:

   {"stmt":"SELECT 1; SELECT content FROM blocks LIMIT 1000;"}
   

   The response returns notebook content, document text, tags, and metadata.
4. Credential Harvesting: Query user tables:

   {"stmt":"SELECT 1; SELECT username, password_hash FROM users;"}
   

   (Schema may differ; iterative SELECT sql FROM sqlite_master reveals table structures.)

Scenario 2: Data Destruction via Read-Write Handle

1. Enumeration: Use SELECT name FROM sqlite_master WHERE type='table'; to map the schema.
2. Destructive Payload: Submit:

   {"stmt":"SELECT 1; DROP TABLE blocks; --"}
   

   This destroys all block content across cleartext notebooks. Recursive execution can continue against io_files, attrs, and assets tables.

Scenario 3: RoleReader Token Abuse

1. Token Acquisition: Attacker obtains a shared publish link containing a RoleReader token (e.g., ?token=abc123...).
2. Auth Bypass: Attacker replays the token in the Authorization header or session cookie.
3. Modification: Execute UPDATE statements to inject malicious content into shared pages (stored XSS or phishing content) or to alter document ownership.

PoC/Exploit Status: Public PoC exists demonstrating unauthenticated stacked-query execution. No Nuclei template or weaponized exploit code has been released as of this report.

Impact Assessment

CVSS Subscore Analysis (10.0):

• Attack Vector: Network (AV:N) — Remotely exploitable.
• Attack Complexity: Low (AC:L) — No special conditions; default configurations vulnerable.
• Privileges Required: None (PR:N) — Anonymous access or reader token suffices.
• User Interaction: None (UI:N) — No victim action needed.
• Scope: Changed (S:C) — Compromise extends beyond the vulnerable component to the entire database and application data.
• Confidentiality: High (C:H) — Full database read; all cleartext notes, attachments metadata, user records.
• Integrity: High (I:H) — Full database write; data destruction, content injection.
• Availability: Not impacted (A:N) — The vulnerability does not directly enable DoS, though DROP TABLE indirectly degrades availability.

Blast Radius:

• All cleartext notebooks in the SiYuan workspace.
• User accounts and credential hashes (if stored in DB).
• Any integration data (sync metadata, S3 configuration, API keys stored in settings).
• Encrypted notebooks remain content-protected but their metadata and structure are still modifiable.

Affected Deployments: Self-hosted SiYuan on NAS, VPS, Docker, or desktop sync servers. Any node exposed to the internet or untrusted networks.

Detection Guidance

Sigma Rule

title: SiYuan searchEmbedBlock SQL Injection Attempt
id: 6d9e4c1a-2b8f-4e7d-9a5c-8c3f1a2b4d5e
status: experimental
description: Detects suspicious SQL keywords in POST requests to /api/search/searchEmbedBlock
logsource:
  category: webserver
  product: nginx
  service: http
detection:
  selection:
    cs-method: POST
    cs-uri-path: /api/search/searchEmbedBlock
    cs-body|contains:
      - ';'
      - 'SELECT'
      - 'DROP'
      - 'INSERT'
      - 'UPDATE'
      - 'DELETE'
      - 'sqlite_master'
      - '--'
  condition: selection and cs-body|contains: 'stmt'
falsepositives:
  - Legitimate advanced search queries (rare)
level: high
tags:
  - attack.t1190
  - cve.2026.69084
  - cwe.89

YARA Rule

rule siyuan_sqlinjection_cve_2026_69084
{
    meta:
        author = "Valters IT SOC"
        description = "Detects SQL injection payloads targeting SiYuan searchEmbedBlock"
        cve = "CVE-2026-69084"
        date = "2026-07-01"
    strings:
        $endpoint = "/api/search/searchEmbedBlock" ascii
        $param = "stmt=" ascii
        $semicolon = ";" ascii wide
        $select = "SELECT" ascii wide
        $drop = "DROP" ascii wide
        $union = "UNION" ascii wide
        $comment = "--" ascii wide
        $master = "sqlite_master" ascii wide
    condition:
        uint16(0) == 0x0A0D and $endpoint and $param and
        (($semicolon and ($select or $drop or $union)) or $comment or $master)
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-69084 SiYuan searchEmbedBlock SQL Injection Attempt";
    flow:to_server,established;
    http.method;
    content:"POST";
    http.uri;
    content:"/api/search/searchEmbedBlock";
    http.request_body;
    pcre:"/(?:SELECT|DROP|INSERT|UPDATE|DELETE|UNION|sqlite_master|--)/i";
    classtype:attempted-admin;
    sid:1006984;
    rev:1;
    reference:cve,2026-69084;
)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.type == "connection" and destination.port in (6806, 6807) ]
  [ http where request.method == "POST" and url.path == "/api/search/searchEmbedBlock"
    and (wildcard(request.body, "*;*") or wildcard(request.body, "*SELECT*")
      or wildcard(request.body, "*DROP*") or wildcard(request.body, "*INSERT*")
      or wildcard(request.body, "*sqlite_master*")) ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method=="POST"
| search uri_path="/api/search/searchEmbedBlock"
| regex _raw="(SELECT|DROP|INSERT|UPDATE|DELETE|UNION|sqlite_master|;)"
| eval risk_score=case(
    match(_raw, "DROP") AND match(_raw, ";") , 100,
    match(_raw, "sqlite_master"), 90,
    match(_raw, "SELECT") AND match(_raw, ";"), 80,
    1=1, 40)
| table _time, src_ip, uri, status, risk_score
| sort - _time

Wazuh OSSEC Rule

<rule id="100684" level="12">
  <if_sid>31100</if_sid>
  <match>POST /api/search/searchEmbedBlock</match>
  <regex>(SELECT|DROP|INSERT|UPDATE|DELETE|UNION|sqlite_master|;)</regex>
  <description>SiYuan CVE-2026-69084 SQL injection attempt detected</description>
  <group>sql_injection,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source. Vendor advisory not yet published. The fix is confirmed only in SiYuan v3.7.3 release notes.

1. Immediate Mitigations:

   • Upgrade SiYuan to v3.7.3 or later immediately. Verify the version via GET /api/system/version.
   • If upgrade is impossible, disable publish functionality entirely (http://<host>:6806/api/system/setPublishAuth with auth disabled) and remove all RoleReader tokens.
   • Restrict network access to the SiYuan web console using a firewall or reverse-proxy ACL — allow only trusted IP ranges.
   • If a reverse proxy is in use, add a WAF rule to block POST requests to /api/search/searchEmbedBlock containing ;, SELECT, DROP, or sqlite_master.

2. Patch/Upgrade Steps:

   • Stop the SiYuan service.
   • Backup siyuan.db, data/, and conf/ directories.
   • Replace the binary or container image with v3.7.3.
   • Restart the service and confirm GET /api/system/version returns v3.7.3.
   • Rotate all publish tokens and force password resets for users whose hashes may have been exposed.

3. Long-Term Hardening:

   • Run SiYuan behind a reverse proxy (nginx/Caddy) with TLS and mandatory authentication.
   • Never expose the node directly to the internet; place it in a DMZ or VPN-only network.
   • Monitor for SQL injection attempts via the detection rules above.
   • Periodically audit siyuan.db for unexpected schema changes or orphaned rows.
   • Track SiYuan security advisories and subscribe to the vendor's security mailing list.

References

• Exploitation in the Wild: A public PoC was released proving unauthenticated stacked-query execution, but no widespread campaign or CISA KEV listing is available. Given the high CVSS and ease of exploitation, opportunistic actors (botnets, crypto-mining groups) are likely to incorporate this into automated scanners within weeks.
• Threat Actors: No APT group has been publicly linked. The most probable attackers are opportunistic threat actors targeting exposed self-hosted services and data extortion groups seeking cleartext personal notes, credentials, or corporate intellectual property stored in SiYuan notebooks.
• CISA KEV: Not listed. This may change as exploitation matures.
• Related CVEs: CVE-2026-69084 is distinct from previous SiYuan issues (e.g., XSS in markdown rendering, path traversal in export) and represents the most severe vulnerability disclosed for the product to date.
• Exploit Confidence: PoC exists; no weaponized module in Metasploit or Nuclei. Attackers with basic SQL knowledge can craft payloads from the PoC.

References

1. NVD — CVE-2026-69084: https://nvd.nist.gov/vuln/detail/CVE-2026-69084
2. SiYuan Release Notes v3.7.3 (vendor fix): https://github.com/siyuan-note/siyuan/releases/tag/v3.7.3
3. Public PoC / Researcher Blog: https://security.valtersit.com/research/cve-2026-69084-poc
4. MITRE ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/
5. CWE-89 SQL Injection Reference: https://cwe.mitre.org/data/definitions/89.html