CVE-2026-72807
Deferred Deferred - Pending Action

SiYuan Second-Order SQL Injection via Template Columns

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that expose the queryBlocks function, which executes raw SQL using string substitution instead of parameterized queries. Attackers can distribute malicious SiYuan documents or packages with crafted template columns that execute arbitrary SQL on a victim's kernel when the package is imported and rendered, enabling read and write access across notebooks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-26
Generated
2026-09-02
AI Q&A
2026-08-13
EPSS Evaluated
2026-08-31
NVD
CVE-2026-72807
EUVD
EUVD-2026-57408

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
siyuan siyuan to 3.7.4 (exc)
siyuan siyuan to 3.7.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72807 is a high-severity second-order SQL injection vulnerability in SiYuan note-taking app versions before v3.7.4. It exists in attribute-view template columns that use the queryBlocks function to execute raw SQL via unsafe string substitution instead of parameterized queries. Attackers can embed malicious SQL in crafted documents or packages. When imported and rendered, the SQL executes with kernel database privileges, allowing data access and modification across notebooks.

Detection Guidance

To detect this vulnerability, inspect SiYuan installations for versions before v3.7.4. Check for malicious template columns in attribute-view files or packages that contain .action{queryBlocks "<arbitrary SQL>" patterns. Review database logs for unusual SQL queries executed via queryBlocks.

Impact Analysis

If you use SiYuan versions before v3.7.4, an attacker could trick you into importing a malicious document or package. This could allow the attacker to read sensitive data from your notebooks, modify or delete notes, or execute further attacks on your system. The attack requires your interaction but no prior privileges.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations using affected SiYuan versions may face compliance violations, data breach notifications, and potential fines if exploited.

Mitigation Strategies

Upgrade SiYuan to v3.7.4 or later to patch the vulnerability. Disable or restrict access to attribute-view template columns if not required. Monitor for suspicious imports of SiYuan documents or packages from untrusted sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72807. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart