SQL Injection Vulnerability in SiYuan Graph Query Endpoint

CVE-2026-100644

What is CVE-2026-100644?

SiYuan versions prior to 3.8.4 exhibit a vulnerability in the graph query endpoint, which allows unauthenticated attackers to exploit the dailyNoteSavePath parameter. This vulnerability arises due to concatenation of SQL commands without proper escaping, enabling attackers to inject malicious SQL through the UNION SELECT statement. Consequently, they can extract sensitive data from any notebooks within the database on sites where authentication is disabled. This poses a significant risk to the integrity and confidentiality of user data.

References