critical · 10CVE-2026-72811Sep 3, 2026

CVE-2026-72811: SiYuan SQL Injection via Backlink and Mention Search

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

SiYuan's backlink and mention search concatenates stored document titles and client keywords into a SQL query without escaping single quotes, letting an anonymous reader inject arbitrary SQL into the…

Packagegithub.com/siyuan-note/siyuan/kernel
Ecosystemgo
Affected< 0.0.0-20260723004839-1a5b3431d5ab
Fixed in0.0.0-20260723004839-1a5b3431d5ab
CVE-2026-72811: SiYuan SQL Injection via Backlink and Mention Search

The problem

The backlink/mention query in kernel/model/backlink.go builds its MATCH condition by concatenating stored block metadata (title, name, alias, anchor text) and the client-supplied keyword field. Only the double-quote character is escaped; the single quote is not.

The constructed statement is executed on the global read-write siyuan.db handle via the SelectBlocksRawStmtNoParse → query() path. The vendored 88250/go-sqlite3 driver supports statement stacking, so a successful breakout can chain arbitrary SQL: cross-notebook reads, writes, and ATTACH.

The getBacklink2, getBacklink, getBacklinkDoc, and getBackmentionDoc endpoints all share this sink and are gated only by CheckAuth, making the first-order (keyword) vector reachable by any publish RoleReader or by an anonymous user when Publish.Auth.Enable is false.

Proof of concept

A working proof-of-concept for CVE-2026-72811 in github.com/siyuan-note/siyuan/kernel, with the exact payload below.

http
POST /api/ref/getBacklink2 HTTP/1.1
Host: 127.0.0.1:6808
Content-Type: application/json

{"id":"<any-valid-block-id>","k":"a'--","mk":""}

The keyword value a'-- is concatenated directly into a SQL MATCH literal such as ... MATCH 'a'--...'. The single quote closes the string literal; -- comments out the rest of the original query. This produces a SQL syntax error on unpatched versions, confirming the client keyword lands in SQL context without sanitization.

The patch commit 1a5b3431d5ab adds ' → '' escaping at the query-construction site in backlink.go, mirroring the escaping already present in the graph-filter and tag-search paths. Storage-side INSERTs (in kernel/sql/upsert.go) use parameterized placeholders and were never the problem; the bug is purely in the reuse path where stored metadata is concatenated rather than bound.

The second-order vector works identically: a document whose title contains a single quote is stored safely by the parameterized indexer, then detonates when that stored title is later concatenated into the backlink query on any kernel that has ingested the document, including via imported .sy or .sy.zip files.

The fix

Upgrade SiYuan to v3.7.4 or later. The fix (commit 1a5b3431d5ab3036b19c1cc79486fedd6906fb57) escapes single quotes in both the client keyword and stored metadata before concatenation in kernel/model/backlink.go. If an immediate upgrade is not possible, disable publish mode or enable Publish.Auth.Enable to block anonymous access to the backlink endpoints.

Reporter not attributed.

References: [1][2][3][4][5]

Related research