CVE-2026-69083 is an SQL injection vulnerability in SiYuan note-taking software affecting versions prior to v3.7.3. The vulnerability exists in the fullTextSearchAssetContent endpoint, which is reachable by unauthenticated users. Attackers can exploit unescaped method parameters and REGEXP clauses to execute arbitrary SQL commands on the read-write asset-content database. This allows unauthorized disclosure, modification, or deletion of data across notebooks. The vulnerability is critical with a CVSS 4.0 base score of 9.9, indicating network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed as of the published date.

An attacker can remotely exploit this vulnerability without authentication to execute arbitrary SQL commands on the database. This can lead to unauthorized reading, modification, or deletion of data across multiple notebooks, severely compromising data confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint if possible and monitor for suspicious activity related to SQL injection attempts.