SiYuan - SQLi (CVE-2026-69084)
Description
SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the underlying driver executes stacked statements, an attacker can read and modify content across all opened cleartext notebooks (encrypted per-box notebooks are excluded). Fixed in v3.7.3.
psychologyCrowdSec Analysis
CVE-2026-69084 is a critical SQL injection vulnerability in SiYuan versions through 3.7.2, affecting the /api/search/searchEmbedBlock endpoint. Because attacker-controlled SQL is executed without adequate restrictions, unauthenticated or low-privileged users can run stacked statements to read and modify content across opened cleartext notebooks, potentially compromising sensitive data and application integrity remotely. The issue is fixed in SiYuan 3.7.3.
CrowdSec has been tracking this vulnerability and its exploits since 25th of August 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-69084 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers target /api/search/searchEmbedBlock with crafted SQL in the stmt JSON field, typically after authenticating through /api/system/loginAuth. The endpoint may allow unauthorized or low-privilege users to execute arbitrary SQL against SiYuan’s database and read or modify notebook content.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-08-03 |
| Rule Released | 2026-08-25 |
| CrowdSec First Seen | 2026-08-28 |