CVE-2026-100644: SiYuan before v3.8.4 SQL Injection via dailyNoteSavePath

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-26 · updated 2026-10-08
Weakness: CWE-89

Description

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database rows from all notebooks.

Affected products

siyuan-note siyuan: before 3.8.4 — fixed in 3.8.4

How to fix

Upgrade to a fixed version: siyuan-note siyuan 3.8.4. Check the vendor advisory for mitigations.

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xr4h-j7cg-q8pc
https://www.vulncheck.com/advisories/siyuan-before-3.8.4-sql-injection-via-dailynotesavepath
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xr4h-j7cg-q8pc

Get alerted when CVE-2026-100644 or the next vulnerability affects your stack