H3-2026-1046¶

SiYuan Note Asset Content Search SQL Injection Vulnerability

Description¶

B3log SiYuan Note contains a SQL injection vulnerability in the FullTextSearchAssetContent function and related API endpoints. The application builds SQL statements by directly concatenating user-controlled input parameters (query, path, id, regex, types) into SQL queries without sanitization. When using the regex search method (method=3), user input is injected into a REGEXP clause, enabling UNION-based SQL injection against the asset content SQLite database. Remote attackers with network access to the SiYuan API can exploit this via crafted POST requests to the /api/search/fullTextSearchAssetContent endpoint.

Impact¶

Successful exploitation exposes all indexed file contents and database schema information stored in the asset content database. Attackers may leverage SQLite capabilities for further data extraction or manipulation. SiYuan Note is widely used by individuals and organizations for knowledge management, making sensitive notes and documents at risk. Industries relying on local-first note-taking solutions with network-exposed instances face significant data breach potential.

References¶

• SiYuan Note SQL Injection Security Advisory
• SiYuan Note GitHub Issue for SQL Injection Fix