CVE-2026-72811: Remote SQL Injection in SiYuan Backlink and Mention Search Engine

The target component is the backlink and mention search engine of the SiYuan note-taking application, specifically implemented in kernel/model/backlink.go. SiYuan utilizes an internal SQLite database (siyuan.db) to store, index, and organize document hierarchies, metadata, and block contents. The search engine allows users to query links and mentions of specific terms across different notebooks, serving as a critical mechanism for document relationship mapping.

This engine relies on SQLite's Full Text Search (FTS) extension to perform high-performance queries across structured blocks of text. The vulnerability, tracked as CVE-2026-72811, is classified under CWE-89 (SQL Injection) and carries a critical CVSS v3.1 base score of 10.0. The vulnerability surfaces because the application constructs dynamic SQL queries by appending client-supplied inputs and database-stored document titles directly into the SQLite MATCH statement string.

The attack surface is exposed directly through public-facing search endpoints, which are active when notebooks are published or when collaborative multi-user modes are enabled. Because the database driver supports statement stacking, a remote unauthenticated attacker can execute arbitrary SQL statements. This allows bypass of logical restrictions, write access to system tables, and potential system compromise beyond the application's sandbox context.

The root cause of CVE-2026-72811 lies in the flawed sanitization logic within searchBackmentionInBox in kernel/model/backlink.go. The system attempts to dynamically generate a SQLite FTS5 MATCH expression by manual string concatenation using a bytes.Buffer. The generated query template encapsulates the full FTS syntax inside single quotes, such as MATCH 'content:(...) '.

While building individual keyword constraints, the application tries to account for the double quotes used to denote specific phrases in FTS. It replaces double quotes with escaped double quotes ("") using strings.ReplaceAll(keyword, "\"", "\"\""). This replacement ensures the internal structure of the FTS query string remains intact and parses correctly as an FTS phrase.

However, the system completely fails to sanitize or escape single quotes (') within either the client-submitted keywords or the document metadata loaded from the database. Because the entire MATCH parameter is enclosed in single quotes, injecting a single quote inside a keyword or title prematurely terminates the string literal boundary of the FTS expression. An attacker can then inject arbitrary SQL commands following the closed single quote.

The vulnerability is further worsened because the Go database driver used by SiYuan allows stacked queries separated by semicolons (;). SQLite compiles and executes sequential statements within a single query execution block on the active connection. This design behavior allows an attacker to pivot from a simple FTS query breakout to full read and write operations on the siyuan.db database.

Prior to the patch, the searchBackmentionInBox function constructed raw SQL statements directly in memory. The application concatenated unsanitized parameters into a local buffer. This process can be modeled visually to understand the data flow from source to sink.

The critical vulnerability resides in how the system built the query inside backlink.go. Below is the vulnerable segment of code demonstrating the raw concatenation logic:

// Vulnerable raw query construction (Pre-patch)
buf.WriteString("SELECT * FROM " + table + " WHERE " + table + " MATCH '" + columnFilter() + ":(")
for i, mentionKeyword := range mentionKeywords {
    mentionKeyword = strings.ReplaceAll(mentionKeyword, "\"", "\"\"")
    buf.WriteString("\"" + mentionKeyword + "\"")
    // ... OR operators are written
}
buf.WriteString(")")
if "" != keyword {
    keyword = strings.ReplaceAll(keyword, "\"", "\"\"")
    buf.WriteString(" AND (\"" + keyword + "\")")
}
buf.WriteString("'") // Closes the FTS single-quote block
buf.WriteString(" AND root_id != '" + rootID + "'")

In the patched code (Commit 1a5b3431d5ab3036b19c1cc79486fedd6906fb57), the developers introduced complete parameterization. They decoupled the structure of the SQL query from the values being filtered.

// Patched secure query construction (Post-patch)
func buildBackmentionQuery(matchExpression, rootID string, limit int) (query string, args []any) {
    query = "SELECT * FROM blocks_fts WHERE blocks_fts MATCH ? AND root_id != ?" +
        " AND type IN ('d', 'h', 'p', 't') ORDER BY id DESC LIMIT ?"
    args = []any{matchExpression, rootID, limit}
    return
}
 
func quoteFTSPhrase(phrase string) string {
    return "\"" + strings.ReplaceAll(phrase, "\"", "\"\"") + "\""
}

This structural shift completely eliminates the possibility of SQL injection. The FTS expression itself is parameterized as a single bound parameter ?, which the database engine treats strictly as a data literal, preventing any injection of SQL syntax.

Exploitation of CVE-2026-72811 can be achieved through two primary attack vectors depending on the attacker's level of access. The first vector is first-order exploitation, which targets public-facing search endpoints. An unauthenticated remote attacker issues a HTTP POST request to the backlink search API.

POST /api/backlink/search HTTP/1.1
Host: target-siyuan.local
Content-Type: application/json
 
{
  "keyword": "exploit') ; ATTACH DATABASE '/tmp/pwn.db' AS pwn; --"
}

The system processes the request and maps the keyword parameter directly into the SQLite search engine. Since the single quote is not escaped, the backend executes the ATTACH DATABASE statement, allowing the attacker to construct arbitrary files on the local filesystem where the application runs.

The second vector is a second-order exploitation approach that occurs when malicious payloads are stored in the database. An attacker with write access creates a block containing a crafted document title with embedded SQL statements. When another user views a document that references this block, the server fetches the document title to search for mentions. The unescaped title is concatenated directly into the FTS engine, executing the payload in the context of the active user session.

The security impact of CVE-2026-72811 is rated as Critical with a CVSS v3.1 score of 10.0. A successful exploitation allows full read and write access to the underlying SQLite database file siyuan.db. This database houses critical application configurations, access tokens, integration keys, and full text contents of all private notebooks.

Because the SQLite connection supports statement stacking, attackers can run arbitrary SQL commands. This capability bypasses any application-level authorization limits. An attacker can extract system configuration parameters, modify document contents, or introduce cross-site scripting (XSS) payloads into notebook pages that execute when other users synchronize or read the affected notebooks.

Additionally, although SQLite does not naturally support standard external system shells, features such as ATTACH DATABASE can be used to write arbitrary files to specific locations on the server, depending on user permissions. In environments running with elevated privileges, this primitive can be leveraged to write local configuration files, leading to remote code execution.

The primary and recommended mitigation for CVE-2026-72811 is to upgrade the SiYuan application to version v3.7.4 or higher. The patch fully mitigates the vulnerability by transitioning the dynamic query construction process into a parameterized SQL statement. This ensures all user-supplied inputs are securely bound as parameter values rather than raw SQL command elements.

If an immediate upgrade is not feasible, several temporary workarounds should be applied to reduce the attack surface. Administrators should immediately disable any public-facing publish mode capabilities on the instance. Restricting the network availability of the SiYuan container or server to local loopback or a secure VPN prevents external threat actors from reaching the affected endpoint.

Deploying Web Application Firewall (WAF) rules can help detect and block exploitation attempts before they reach the application. A custom WAF rule can monitor the request body of search endpoints for unescaped single quotes combined with SQL keywords. This validation layer serves as an effective defense-in-depth measure while the core application is scheduled for an update.