CVE-2026-100644 describes a SQL injection vulnerability in SiYuan note-taking software before version 3.8.4. The flaw exists in the graph query endpoint where the dailyNoteSavePath parameter is directly concatenated into SQL queries without sanitization or escaping. This improper neutralization of special elements enables unauthenticated attackers, particularly on published sites with authentication disabled, to perform UNION SELECT injections. Exploitation can lead to unauthorized disclosure of arbitrary database rows across all notebooks managed by the software.

An attacker can exploit this vulnerability to extract arbitrary data from the application's database without authentication. This compromises confidentiality of all notebooks stored in the system. The vulnerability has a high CVSS 4.0 score of 8.7, indicating a severe risk of data exposure via remote, unauthenticated access with no user interaction required.

Upgrade SiYuan to version 3.8.4 or later, where this SQL injection vulnerability has been fixed. Until then, ensure that published sites have authentication enabled to prevent unauthenticated access. No other mitigations are specified. Patch status is confirmed by the version boundary indicating the fix in 3.8.4.