VYPR
advisoryPublished Aug 3, 2026· Updated Aug 11, 2026· 1 source

Siyuan Note: Eight Critical and High-Severity Vulnerabilities Disclosed Together

Key findings • Eight vulnerabilities in Siyuan Note versions prior to v3.7.3 disclosed on August 3, 2026. • Critical SQL injection flaws in multiple API endpoints allow arbitrary SQL executio…

Key findings

  • Eight vulnerabilities in Siyuan Note versions prior to v3.7.3 disclosed on August 3, 2026.
  • Critical SQL injection flaws in multiple API endpoints allow arbitrary SQL execution.
  • Path traversal and authentication bypass vulnerabilities enable unauthorized access to files and content.
  • Information disclosure vulnerabilities expose sensitive document metadata and content.
  • All vulnerabilities are patched in Siyuan Note v3.7.3.
  • Flaws affect both authenticated users and unauthenticated access points.

On August 3, 2026, a batch of eight vulnerabilities was disclosed for Siyuan Note, impacting versions prior to v3.7.3. The vulnerabilities, primarily SQL injection and information disclosure flaws, pose a significant risk to users, with several rated as Critical. The disclosures highlight weaknesses in how Siyuan Note handles user-supplied parameters and access controls, particularly in its API endpoints.

Several critical vulnerabilities stem from SQL injection flaws. CVE-2026-69085 and CVE-2026-69084, both rated Critical (CVSSv3 10.0), allow attackers to execute arbitrary SQL commands. CVE-2026-69085 affects the /api/filetree/searchDocs endpoint, concatenating user input directly into SQL statements. CVE-2026-69084 impacts the /api/search/searchEmbedBlock endpoint, which passes client-supplied SQL verbatim to the database. Additionally, CVE-2026-69083, also Critical (CVSSv3 10.0), contains SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint, reachable by unauthenticated users and those with RoleReader permissions. These flaws could allow attackers to read, modify, or delete sensitive data.

Other high-severity vulnerabilities include path traversal and information disclosure. CVE-2026-69086 (High, CVSSv3 7.7) allows authenticated users or anonymous clients to construct traversal paths that escape the storage directory, potentially accessing sensitive files. CVE-2026-68587 (High, CVSSv3 8.6) involves information disclosure through various getHeading*Transaction endpoints, returning rendered block DOM without proper access checks. Similarly, CVE-2026-68586 (High, CVSSv3 8.6) fails to filter publish-forbidden documents in getBacklinkDoc and getBackmentionDoc endpoints, exposing content that should be protected. CVE-2026-68584 (High, CVSSv3 8.6) presents an authentication bypass in publish mode for several content-returning endpoints, allowing access to full document content.

A medium-severity vulnerability, CVE-2026-68585 (Medium, CVSSv3 5.8), involves metadata disclosure. The /api/block/getBlockInfo endpoint returns document root metadata, including titles for restricted documents, without proper access checks, even to anonymous readers or RoleReader tokens.

All disclosed vulnerabilities were addressed in Siyuan Note version v3.7.3. Users are strongly advised to update to this version to mitigate the risks associated with these critical and high-severity flaws. The batch of disclosures highlights the importance of robust input validation and strict access control enforcement across all API endpoints, especially those handling sensitive data or database interactions.

The coordinated disclosure of these eight vulnerabilities underscores the need for diligent security practices by both developers and users. The severity of the SQL injection and path traversal flaws, in particular, warrants immediate attention from Siyuan Note users. Promptly updating to version v3.7.3 is the most effective way to protect against potential exploitation.

The vulnerabilities were disclosed on August 3, 2026. The affected versions are all prior to v3.7.3. The patched version is v3.7.3.

Key findings include:

  • Multiple critical SQL injection vulnerabilities (CVE-2026-69085, CVE-2026-69084, CVE-2026-69083) allow arbitrary SQL execution.
  • Path traversal (CVE-2026-69086) and authentication bypass (CVE-2026-68584) vulnerabilities pose significant risks.
  • Information disclosure flaws (CVE-2026-68587, CVE-2026-68586, CVE-2026-68585) expose sensitive document content and metadata.
  • All eight vulnerabilities are fixed in Siyuan Note v3.7.3.
  • Access control weaknesses in API endpoints are a recurring theme across the disclosed CVEs.
  • Vulnerabilities are reachable by unauthenticated users or those with RoleReader permissions.
Synthesized by Vypr AI