CVE-2026-69085 siyuan-note CVE debrief

Who should care

SiYuan users, administrators, and security teams should assess exposure and prioritize remediation. They should verify their instances, restrict access to the endpoint, and update to the latest version. Security teams should review compensating controls for exposed systems and monitor for suspicious activity on the instance.

Why it matters

CVE-2026-69085 is a critical unauthenticated SQL injection vulnerability in SiYuan's searchDocs endpoint. It allows attackers to read and write database content across all cleartext notebooks on the instance. SiYuan users and administrators should verify their instances, restrict access to the endpoint, and update to the latest version.

• Potential unauthorized data access and modification across notebooks.
• Risk of data tampering and integrity loss.
• Possible lateral movement within the instance.
• Need for urgent verification and patching

Technical summary

The /api/filetree/searchDocs endpoint in SiYuan is vulnerable to unauthenticated SQL injection. The endpoint concatenates user-supplied search keywords directly into SQL statements without proper escaping or parameter binding. This allows attackers to execute stacked SQL statements, potentially leading to read and write access across all non-encrypted notebooks on the instance. The vulnerability exists in the kernel/api/filetree.go and kernel/model/file.go files, where the search keyword is passed directly to the SearchDocs function without sanitization.

Defensive priority

High priority for SiYuan users to verify and update their instances.

Recommended defensive actions

• Verify SiYuan instance configurations and update to the latest version.
• Restrict access to the searchDocs endpoint.
• Monitor for suspicious activity on the instance.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability exists in the /api/filetree/searchDocs endpoint, which concatenates user-supplied search keywords directly into SQL statements without escaping or parameter binding. This allows unauthenticated requests to read and write database content across all cleartext notebooks on the instance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.