VulnSocial

CVE-2026-69085Disclosure

MEDIUMCVSS 9.9 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into SQL statements with no escaping or parameter binding. The endpoint is reachable by a publish RoleReader token, or unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. Because the statement executes on a read-write SQLite handle via a driver that supports stacked (semicolon-separated) statements, an attacker can read and modify database content across all cleartext (non-encrypted) notebooks on the instance.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 2d ago at 1 mentions (2026-08-03); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-08-03: 1Mentions · 2026-08-14: 1Mentions · 2026-09-18: 1PoC Mentioned / Linked · 2026-09-18: 1Exploit Tool / Code · 2026-09-18: 1Patch / Workaround · 2026-08-03: 1Patch / Workaround · 2026-09-18: 1Technical Details · 2026-08-03: 1Technical Details · 2026-08-14: 1Technical Details · 2026-09-18: 108-0308-1409-18
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-08-031
Patch1
2026-08-141
Disclosure1
2026-09-181
Disclosure1
Full discourse3 posts
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-69085 - critical 🚨 SiYuan <=3.7.2 - SQL Injection > SiYuan before v3.7.3 contains a SQL injection caused by direct concatenation of the k... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-69085 @pdnuclei #NucleiTemplates #cve

    Post summary

    The tweet discloses CVE-2026-69085 as a critical SQL injection vulnerability affecting SiYuan versions ≤3.7.2 due to direct concatenation, providing a link to ProjectDiscovery's Nuclei template library for PoC/exploit code and implicitly identifying v3.7.3 as the fixed version.

    01071474
    1.4K followersView on X
  • SECNORA®@secnorainfosec
    Disclosure

    🚨 CVE-2026-69085: Unauthenticated SQL Injection in SiYuan's “searchDocs" Endpoint An unauthenticated SQL injection flaw allows arbitrary SQL execution in publish mode, earning a maximum CVSS v3.1 score of 10.0. 🔗 Read the full technical analysis: https://secnora.com/blog/cve-2026-69085-siyuan-sql-injection/

    Post summary

    The text announces the discovery of CVE-2026-69085, an unauthenticated SQL injection in SiYuan’s ‘searchDocs’ endpoint that permits arbitrary SQL execution with a maximum CVSS v3.1 score of 10.0.

    0000037
    76 followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨Critical - SiYuan SQLi via filetree searchDocs keyword (CVE-2026-69085) SiYuan kernel /api/filetree/searchDocs concatenates the user-supplied keyword into SQL without escaping/binding. Reachable with a publish RoleReader token, or unauthenticated when Publish.Auth.Enable=false; stacked SQL on a read-write SQLite handle enables read/modify of DB content across all cleartext notebooks. 👉Affected: http://github.com/siyuan-note/siyuan/kernel < 3.7.3 | Upgrade to 3.7.3

    Post summary

    A critical SQL injection vulnerability (CVE‑2026‑69085) exists in SiYuan’s /api/filetree/searchDocs endpoint, exploitable via unauthenticated or RoleReader tokens, and can be mitigated by upgrading to version 3.7.3.

    0000097
    280 followersView on X

Explore more

Back to dashboard