CVE-2026-100644
Deferred Deferred - Pending Action

SiYuan Graph Query SQL Injection via dailyNoteSavePath

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database rows from all notebooks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100644
EUVD
EUVD-2026-87738

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.8.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100644 is a SQL injection vulnerability in SiYuan, a note-taking app, affecting versions before v3.8.4. The flaw occurs in the graph query endpoint where the dailyNoteSavePath parameter is directly concatenated into SQL queries without proper escaping. Attackers can inject malicious SQL code via UNION SELECT statements to extract arbitrary database rows from all notebooks on published sites with authentication disabled.

Detection Guidance

To detect this vulnerability, check if your SiYuan instance is running a version prior to v3.8.4. Inspect network traffic for suspicious SQL injection attempts targeting the graph query endpoint, particularly UNION SELECT statements in the dailyNoteSavePath parameter. Review server logs for unauthorized database access patterns or unusual queries.

Impact Analysis

Unauthenticated attackers can access sensitive data from all notebooks, including unpublished content like bank PINs. The attack requires visiting a published site with auth disabled or tricking an admin into importing a malicious notebook. Data extraction happens in a single request without authentication.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to sensitive personal data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. The flaw enables bulk data exposure, creating significant compliance risks for affected organizations.

Mitigation Strategies

Immediately upgrade SiYuan to version v3.8.4 or later to patch the vulnerability. If upgrading is not possible, disable public access to published sites or enable authentication for published content. Monitor for any signs of exploitation and review database access logs for unauthorized queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100644. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart