Description

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database rows from all notebooks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-26T14:16:46.583Z",
  "pubdate": "2026-09-26T14:16:46.583Z",
  "executiveSummary": "SiYuan versions prior to 3.8.4 are susceptible to a critical SQL injection vulnerability residing within the application's graph query endpoint.\nThe vulnerability originates from improper neutralization of user-supplied input, specifically within the 'dailyNoteSavePath' parameter, which is concatenated directly into SQL queries without adequate sanitization or parameterization.\nAn unauthenticated attacker can exploit this flaw on published sites where authentication mechanisms are disabled to execute arbitrary SQL commands.\nSuccessful exploitation allows unauthorized access to the underlying database, facilitating the exfiltration of sensitive information across all notebooks stored within the instance.\nThe risk is categorized as high due to the potential for complete data compromise and the minimal requirement for authentication on exposed instances.\nThis vulnerability highlights a critical breakdown in input validation and query construction processes, necessitating immediate remediation to prevent data exfiltration by remote, unauthenticated actors.",
  "technicalDetails": "The vulnerability exists within the graph query handling logic of SiYuan, specifically affecting the processing of the 'dailyNoteSavePath' parameter provided to the graph query endpoint.\nThe root cause is the usage of insecure string concatenation to build database queries. Instead of utilizing prepared statements with parameterized inputs, the application embeds the raw input from 'dailyNoteSavePath' directly into the SQL command string.\nThis design flaw allows an attacker to break out of the intended query context by injecting malicious SQL syntax.\nThe exploitation flow typically involves an attacker crafting a request containing a 'UNION SELECT' payload within the 'dailyNoteSavePath' parameter. Because the application fails to perform input validation or escape the input, the database engine interprets the injected portion as a valid part of the command structure rather than literal data.\nBy leveraging 'UNION SELECT', an attacker can append their own queries to the original query executed by the application. This permits the attacker to retrieve data from arbitrary tables within the SQLite database associated with SiYuan.\nSince the vulnerability is reachable through the graph query endpoint on published sites where authentication is disabled, it is exposed to the public network. An attacker does not require valid credentials or high-level privileges to initiate the attack; simple HTTP requests targeting the vulnerable endpoint are sufficient.\nThe post-exploitation impact is severe, as the attacker can perform database-wide queries to extract, modify, or potentially corrupt sensitive user data stored across all notebooks managed by the SiYuan instance.\nThe vulnerability remains present in all versions prior to 3.8.4, where the vulnerable component (the graph query logic) remains unpatched. Mitigation requires replacing direct string concatenation with safe database interaction patterns, such as bound parameters, to ensure user input is treated strictly as data and never as executable code."
}