CVE-2026-69083

CVE-2026-69083 is a pair of SQL injection flaws in SiYuan's /api/search/fullTextSearchAssetContent endpoint, which is reachable on the publish (shared-notes) surface by any reader-role token, or anonymously when Publish.Auth.Enable is false. The 'method 2' code path passes a fully client-controlled SQL statement straight to a read-write SQLite asset-content database with no single-statement or read-only guard, and unlike the sibling fullTextSearchBlock endpoint it lacks the admin-only restriction that normally gates raw SQL. The 'method 3' path builds a REGEXP clause by concatenating the client expression without escaping single quotes, letting an attacker break out of the SQL literal, even though the equivalent block-search builder does escape. An unauthenticated attacker can therefore run arbitrary SQL against the cross-notebook asset-content database (CVSS 10, C:H/I:H), enabling data exfiltration and modification. No public proof-of-concept, KEV listing, or known in-the-wild exploitation is reported, and EPSS is 0.4%.

What to do: Upgrade SiYuan to the vendor release addressing CVE-2026-69083 (see the vendor advisory for the fixed version, which is not stated in the available data). Until patched, enable authentication on publish mode (Publish.Auth.Enable=true so anonymous access is off), avoid exposing /api/search/fullTextSearchAssetContent to untrusted networks, and audit internet-facing SiYuan servers for use of this endpoint. Note the read-write database handle means successful SQL injection could both read and modify asset-content data.