CVE-2026-69085 describes a SQL injection vulnerability in SiYuan note-taking software before version 3.7.3. The vulnerability exists in the /api/filetree/searchDocs endpoint where the keyword parameter is concatenated directly into SQL queries without escaping or parameter binding. The endpoint can be accessed with a publish RoleReader token or unauthenticated if publish mode is enabled without authentication. Because the underlying SQLite driver supports stacked SQL statements on a read-write handle, an attacker can execute arbitrary SQL commands to read and modify database content across all unencrypted notebooks on the instance.

Successful exploitation allows an attacker with minimal or no privileges to execute arbitrary SQL commands on the application's database. This can lead to unauthorized reading and modification of all cleartext notebook data stored in the database, compromising confidentiality and integrity of user data. The vulnerability has a CVSS 4.0 base score of 9.9, indicating critical severity with network attack vector, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable publish mode or ensure Publish.Auth.Enable is set to true to require authentication. Avoid exposing the vulnerable endpoint to untrusted users. Monitor vendor channels for updates and apply official patches once released.