SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenate…

SiYuan versions before v3.7.3 contain a SQL injection vulnerability in the /api/filetree/searchDocs endpoint. The keyword parameter is directly concatenated into SQL queries without escaping or parameterized binding. The vulnerability is exploitable by users with a publish RoleReader token, or entirely unauthenticated when publish mode is enabled with Publish.Auth.Enable set to false. The underlying SQLite handle is read-write and the driver supports stacked (semicolon-separated) statements, allowing attackers to both read and modify database content. All cleartext (non-encrypted) notebooks on the affected instance are at risk. The fix was introduced in SiYuan v3.7.3. This vulnerability has been documented by NVD, GitHub Security Advisories, and VulnCheck.