CVE-2026-100644

7.5 HIGHpublic exploit available

Published 2026-09-26 · Updated 2026-09-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without escaping. Unauthenticated attackers on published sites with auth disabled can inject SQL via UNION SELECT to extract arbitrary database rows from all notebooks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-89

Public exploit & PoC references

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xr4h-j7cg-q8pc
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xr4h-j7cg-q8pc

All references

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xr4h-j7cg-q8pc
https://www.vulncheck.com/advisories/siyuan-before-3.8.4-sql-injection-via-dailynotesavepath
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xr4h-j7cg-q8pc

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2015-20122
HIGHCVE-2019-25776PoC
HIGHCVE-2021-48008
HIGHCVE-2022-4997
CRITICALCVE-2023-54399
CRITICALCVE-2023-54400PoC
CRITICALCVE-2025-63564
MEDIUMCVE-2026-100312PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.