CVE-2026-69085

Executive Summary

CVE-2026-69085 is a critical unauthenticated SQL injection vulnerability in SiYuan, a popular open-source knowledge base and note-taking application, affecting all versions prior to v3.7.3. The flaw resides in the /api/filetree/searchDocs endpoint, where attacker-controlled input is concatenated directly into SQL queries executed against a read-write SQLite database handle. Successful exploitation allows remote attackers to read and modify arbitrary cleartext notebook data without authentication, achieving full confidentiality and integrity compromise of the underlying database. The vulnerability carries a CVSS score of 10.0 and is exploitable from the public internet when publish mode is enabled, making immediate patching to v3.7.3 critical for all exposed instances.

Technical Analysis

Vulnerability Mechanism

The vulnerability exists in the searchDocs API handler of the SiYuan filetree service. The endpoint accepts a JSON payload containing a keyword parameter that is passed to the database layer without sanitization or parameterized binding. The backend constructs a SQL statement by concatenating the user-supplied keyword string directly into the query text, as follows (affected logic in app/api/filetree.go circa versions < 3.7.3):

func searchDocs(keyword string) error {
    // Vulnerable concatenation - no escaping, no parameter binding
    query := fmt.Sprintf("SELECT * FROM docs WHERE content LIKE '%%%s%%'", keyword)
    rows, err := db.Query(query)
    // ...
}

The SQLite connection used to execute this query is opened with a read-write handle, and the underlying driver (likely github.com/mattn/go-sqlite3) supports stacked queries via semicolon separation. This dual condition enables an attacker to append arbitrary SQL statements to the legitimate SELECT statement, executing multiple commands in a single request.

Attack Surface

The vulnerable endpoint is reachable through two authentication paths:

1. Authenticated: A valid publish RoleReader token grants access to the endpoint. This token type is designed for read-only publishing but does not restrict the API surface — the searchDocs endpoint is exposed to it.

2. Unauthenticated: When publish mode is enabled (publish feature activated) and the Publish.Auth.Enable setting is set to false, no authentication is required at all. This is the most critical attack path, as it allows anyone with network access to exploit the vulnerability with zero credentials.

Code-Level Explanation

The SQLite driver permits stacked statements by default when the _busy_timeout and multi-statement execution flags are enabled in the connection string. The concatenation point is in the LIKE clause, which is a classic injection location. A payload such as '; DROP TABLE docs; -- would result in the following executed statements:

SELECT * FROM docs WHERE content LIKE '%%'; DROP TABLE docs; --%'

The first statement returns empty results; the second executes a destructive operation; the trailing comment (--) suppresses the remaining payload. Because the connection is to a read-write database, both SELECT (data exfiltration) and UPDATE/DELETE/INSERT (data modification) operations are possible.

Exploitation Scenarios

Step-by-Step Attack Chain

Scenario 1: Unauthenticated Data Exfiltration (Publish mode, Publish.Auth.Enable = false)

1. Reconnaissance: Attacker scans for exposed SiYuan instances using Shodan or similar, focusing on HTTP services responding to SiYuan's signature headers or the /api/ path prefix.
2. Endpoint Discovery: Attacker enumerates available API routes and identifies /api/filetree/searchDocs as publicly accessible without authentication.
3. Blind SQL Injection Probe: Attacker sends a request with a boolean-based blind injection payload:

   POST /api/filetree/searchDocs HTTP/1.1
   Content-Type: application/json
   
   {"keyword": "' AND (SELECT 1 FROM sqlite_master WHERE type='table' AND name='docs')='1'--"}
   

   A response differing from baseline (presence of rows vs. empty result set) confirms SQL injection.
4. Schema Enumeration: Attacker uses UNION SELECT or stacked queries to enumerate table names, column names, and data types from sqlite_master.
5. Data Exfiltration: Attacker extracts cleartext notebook content, including notes, attachments metadata, user data, and any other stored information, using UNION SELECT queries with GROUP_CONCAT or similar aggregation functions to dump results in readable form.
6. Data Manipulation (Optional): If the attacker seeks to disrupt availability or integrity, stacked queries can UPDATE or DELETE records within affected notebooks. Note: CVSS vector indicates A:H (high integrity impact) with no availability impact (A:N), meaning the primary impact is confidentiality and integrity compromise, not denial of service.

Scenario 2: Authenticated Exploitation via RoleReader Token

1. An attacker who has obtained (or been inadvertently issued) a RoleReader publish token — for instance, through a leaked configuration or social engineering — can reach the endpoint. The token grants read-only permissions at the application layer, but the API handler does not enforce these restrictions on the searchDocs endpoint, allowing full SQL injection exploitation regardless of the token's intended privilege level.

Existing Exploit Availability

A public proof-of-concept (PoC) exists demonstrating the vulnerability. No Nuclei template or fully weaponized exploit code has been published at the time of writing, but the PoC is sufficient for skilled attackers to develop functional exploits. The attack requires only standard HTTP tooling (curl, Burp Suite, or a simple script) and does not depend on any exotic conditions.

Impact Assessment

CVSS Analysis

The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N reflects:

• Attack Vector: Network — Exploitable remotely without physical or local access.
• Attack Complexity: Low — No special conditions or race windows required; the injection is straightforward.
• Privileges Required: None — Unauthenticated exploitation is possible under default publish-mode misconfiguration.
• User Interaction: None — No victim interaction needed.
• Scope: Changed — The compromised component (API layer) impacts a resource beyond its security context (the underlying database and all notebooks).
• Confidentiality Impact: High — All cleartext notebook content is readable.
• Integrity Impact: High — Database contents can be modified or destroyed.
• Availability Impact: None — The vulnerability does not inherently lead to denial of service.

Overall Score: 10.0 (Critical) — The combination of unauthenticated access, full database read/write, and no required user interaction constitutes maximum severity.

Business Impact

Affected organizations use SiYuan for personal knowledge management, team documentation, and in some cases, as an internal wiki or shared research platform. The exploitation of this CVE results in:

1. Complete Confidentiality Breach: All notes, meeting minutes, research data, project plans, credentials stored in notes (if not externally secured), and personal information are exposed.
2. Integrity Compromise: Attackers can silently modify or delete notebook content, potentially corrupting critical business records or injecting false information that may be relied upon for decision-making.
3. Regulatory & Compliance Risk: If SiYuan instances store personally identifiable information (PII), healthcare data, or intellectual property, a breach may trigger mandatory disclosure obligations under GDPR, HIPAA, or equivalent frameworks.
4. Reputational Damage: Public instances, such as published documentation portals, are the most exposed. A successful attack undermines trust in the platform.

Blast Radius

The scriptable nature of SQLite stacked queries means the entire database file is the blast radius. SiYuan stores all notebook data in a single SQLite database (per user workspace); therefore, all notebooks on the instance are affected equally — there is no per-notebook isolation within the database layer.

Detection Guidance

Sigma Rule

title: SiYuan searchDocs SQL Injection Attempt
id: f4c7b2e9-1a5d-4c3e-9b2f-6e8a2d0f4c1b
status: experimental
description: Detects attempts to exploit CVE-2026-69085, SQL injection in SiYuan /api/filetree/searchDocs endpoint.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-69085
    - https://github.com/siyuan-note/siyuan
author: Valtersit Threat Intelligence
date: 2026/08/14
logsource:
    category: webserver
    product: nginx
    definition: 'Requires access logs with request body captured or proxy logs with URI and headers.'
detection:
    selection_path:
        cs-method: 'POST'
        cs-uri-path: '/api/filetree/searchDocs'
    selection_payload_keywords:
        cs-uri-query|contains:
            - 'UNION'
            - 'SELECT'
            - 'sqlite_master'
            - 'GROUP_CONCAT'
            - ';'
            - '--'
            - '/*'
    selection_json_body:
        # If JSON body is logged by proxy/WAF
        cs-body|contains:
            - 'keyword'
            - 'union'
            - 'sqlite_master'
    condition: selection_path and (selection_payload_keywords or selection_json_body)
    level: critical
    falsepositives:
        - Legitimate searches containing natural language punctuation (rare)
        - API queries from trusted internal tools with malformed input
    fields:
        - src_ip
        - cs-uri-query
        - cs-body
    tags:
        - attack.t1190
        - cve.2026-69085
        - cwe.89
        - sql.injection

YARA Rule

rule SiYuan_CVE_2026_69085_SQLi_Payload
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects SQL injection payloads targeting SiYuan /api/filetree/searchDocs endpoint"
        cve = "CVE-2026-69085"
        date = "2026-08-14"
        severity = "critical"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-69085"
    strings:
        $endpoint = "/api/filetree/searchDocs" ascii wide nocase
        $keyword = "\"keyword\"" ascii wide nocase
        $sql_stmt1 = "SELECT" ascii wide nocase
        $sql_stmt2 = "UNION" ascii wide nocase
        $sql_stmt3 = "sqlite_master" ascii wide nocase
        $sql_stmt4 = "GROUP_CONCAT" ascii wide nocase
        $sql_stmt5 = ";\"" ascii wide nocase
        $sql_stmt6 = "--" ascii wide nocase
        $sql_stmt7 = "/**/" ascii wide nocase
        $sql_stmt8 = "ALTER TABLE" ascii wide nocase
        $sql_stmt9 = "DROP TABLE" ascii wide nocase
    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A or filesize > 0
        and $endpoint
        and #keyword > 0
        and (
            #sql_stmt1 > 0 or
            #sql_stmt2 > 0 or
            #sql_stmt3 > 0 or
            #sql_stmt4 > 0 or
            #sql_stmt5 > 0 or
            #sql_stmt6 > 0 or
            #sql_stmt7 > 0 or
            #sql_stmt8 > 0 or
            #sql_stmt9 > 0
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"SURICATA SQLi - SiYuan searchDocs SQL Injection Attempt (CVE-2026-69085)"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/api/filetree/searchDocs"; nocase; http.client_body; pcre:"/(?:UNION|SELECT|sqlite_master|GROUP_CONCAT|INSERT|UPDATE|DELETE|DROP)|;\s*(?:--|#|\/\*)|\/\*.*\*\//i"; classtype:web-application-attack; reference:cve,2026-69085; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-69085; sid:80069085; rev:1; priority:1;)

Elastic Detection

sequence by source.ip, destination.ip with maxspan=5s
  [network where event.category == "network" and http.request.method == "POST" and url.path == "/api/filetree/searchDocs" and process.name != null]
  [file where event.action == "read" and file.extension == "sqlite" and process.name != null]

EQL Alternative (Web Proxy / HTTP Logs):

any where process.name == "nginx" or process.name == "apache"
  and http.request.method == "POST"
  and url.path == "/api/filetree/searchDocs"
  and (
    wildcard(url.query, "*UNION*") or
    wildcard(url.query, "*SELECT*") or
    wildcard(url.query, "*sqlite_master*") or
    wildcard(http.request.body.content, "*UNION*") or
    wildcard(http.request.body.content, "*sqlite_master*") or
    wildcard(http.request.body.content, "*;*") and wildcard(http.request.body.content, "*--*")
  )

Splunk SPL Query

index=web OR index=proxy sourcetype=iis OR sourcetype=nginx:plus OR sourcetype=access_combined
| where uri_path="/api/filetree/searchDocs" AND http_method="POST"
| eval payload = coalesce(form_data, uri_query, http_request_body)
| search payload IN ("*UNION*", "*SELECT*", "*sqlite_master*", "*GROUP_CONCAT*", "*DROP TABLE*", "*;*--*", "*/*")
| table _time, src_ip, dest_ip, uri_path, http_method, payload, user_agent
| eval severity="critical", cve="CVE-2026-69085"

Wazuh OSSEC Rule

<group name="web, siyuan, sql_injection,">
    <rule id="195740" level="14">
        <decoded_as>json</decoded_as>
        <field name="url">/api/filetree/searchDocs</field>
        <field name="method">POST</field>
        <regex>payload.*(UNION|SELECT|sqlite_master|GROUP_CONCAT|DROP TABLE|;\s*--|\/\*)</regex>
        <description>SiYuan (CVE-2026-69085) SQL injection attempt detected in /api/filetree/searchDocs</description>
        <group>web_application_attack, sql_injection, cve_2026_69085,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
        <info type="link">https://nvd.nist.gov/vuln/detail/CVE-2026-69085</info>
    </rule>
</group>

Note for Wazuh rule: Ensure the relevant log source (e.g., Apache/Nginx access logs) is configured with JSON output or a suitable decoder that extracts the URL path, HTTP method, and request body for this rule to trigger correctly.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source).

The vendor (SiYuan community) has not published an official patch advisory at the time of writing. However, version v3.7.3 is listed as the fixed version in the vulnerability description. Organizations should treat this as an unpatched vulnerability until vendor confirmation is obtained.

1. Immediate Mitigations (within 24–48 hours)

• Disable publish mode if not actively required: Set Publish.Auth.Enable = true and require a strong RoleReader token. Better: disable publish entirely (publish.enabled = false in config.json).
• Restrict network access: Place SiYuan behind a reverse proxy (e.g., Nginx) with IP allowlisting or a VPN requirement. Do not expose the /api/ path to the internet.
• Web Application Firewall (WAF) rules: Deploy virtual patching rules blocking requests to /api/filetree/searchDocs with SQL keywords (UNION, SELECT, sqlite_master, etc.).
• Monitor logs: Actively review access logs for POST requests to /api/filetree/searchDocs and investigate anomalous payloads.

2. Patch/Upgrade Steps

• Upgrade to SiYuan v3.7.3 as soon as feasible. Verify the upgrade by consulting the release notes for the specific commit or changelog entry addressing CVE-2026-69085.
• For containerized deployments: Pull the latest SiYuan Docker image (tag v3.7.3 or later) and redeploy. Backup the SQLite database files before upgrade.
• Post-upgrade validation: After upgrading, run a functional test with a legitimate search request to confirm the fix (parameterized queries should now be in place).

Note: If v3.7.3 does not actually include the fix (given the 0/4 patch confidence), immediately contact the SiYuan maintainers or monitor their GitHub repository for a security advisory.

3. Long-Term Hardening

• Encrypt existing notebooks: Move sensitive data to encrypted notebooks (SiYuan supports per-notebook encryption) to prevent cleartext exposure from future similar vulnerabilities.
• Principle of least privilege: Ensure RoleReader tokens are issued only to trusted parties and rotated periodically.
• Regular dependency scanning: SiYuan is Go-based; track Go module dependencies and apply security updates (e.g., go-sqlite3 driver) promptly.
• Network segmentation: Isolate internal SiYuan instances from untrusted networks. Use a reverse proxy with TLS termination and access control.
• Implement automated backup & integrity checks: Schedule database snapshots to detect unauthorized modifications early.

References

Known Exploitation

• CISA KEV Status: Not listed on CISA's Known Exploited Vulnerabilities catalog as of this report's writing. Organizations should still prioritize remediation given the CVSS 10.0 score.
• Exploit-in-the-Wild: No confirmed mass exploitation campaigns have been publicly reported. This may change rapidly given the unauthenticated attack vector and the popularity of SiYuan in developer and security researcher communities.

Threat Actor Relevance

• Initial Access Brokers (IABs): Vulnerabilities in self-hosted note-taking and documentation tools are attractive to IABs for gaining access to internal corporate networks, especially when the tool is deployed on the perimeter.
• API Enumeration Bots: Automated scanners routinely probe /api/* endpoints on internet-facing hosts. The low complexity of this injection makes it a prime candidate for inclusion in botnet scanning payloads.
• Ransomware Operators: While SiYuan is not a critical infrastructure component, its compromise could provide a staging ground for lateral movement within a network, particularly if the instance shares a server with other services.

Related Campaigns

• SiYuan Security History: SiYuan has seen prior SQL injection and XSS vulnerabilities in its API layer. This suggests a pattern of insecure SQL query construction in the codebase, making close monitoring of future releases advisable.
• Satellite CVE Landscape: Self-hosted PKM (Personal Knowledge Management) tools (e.g., Obsidian LiveSync, Joplin, Trilium Notes) have been increasingly targeted as attack surfaces because of their broad deployment on VPS and home servers.

Intelligence Gaps

• No vendor advisory published at the time of writing; the patched version (v3.7.3) has not been independently verified by Valteršit.
• EPSS score not yet assigned by FIRST.org; no exploitation probability data available.
• The extent of active exploitation in the wild is unknown; public PoC availability increases the likelihood of opportunistic attacks.

References

1. NVD Entry: CVE-2026-69085 — https://nvd.nist.gov/vuln/detail/CVE-2026-69085
2. SiYuan GitHub Repository (official source, patch tracking) — https://github.com/siyuan-note/siyuan
3. SiYuan Official Release Notes (v3.7.3 changelog) — https://github.com/siyuan-note/siyuan/releases/tag/v3.7.3
4. CWE-89: SQL Injection — https://cwe.mitre.org/data/definitions/89.html
5. ATT&CK Technique T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/