CVE-2026-72811

🗓️ 14 Aug 2026 11:35:24Reported by VulnCheckType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 46 Views🌐 WEB

SQL injection in SiYuan up to v3.7.2 via unescaped single quote enables arbitrary SQL on siyuan.db.

Reporter	Title	Published	Views	Family All 64
attackerkb	CVE-2026-72811	14 Aug 202611:35	–	attackerkb
Circl	CVE-2026-72811	14 Aug 202612:20	–	circl
Cvelist	CVE-2026-72811 SiYuan before v3.7.4 SQL Injection via backlink search	14 Aug 202611:35	–	cvelist
EUVD	EUVD-2026-58626	3 Sep 202622:27	–	euvd
Github Security Blog	Duplicate Advisory: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle	14 Aug 202612:31	–	github
Github Security Blog	SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle	3 Sep 202622:27	–	github
Mend	CVE-2026-72811	14 Aug 202611:35	–	mend
NVD	CVE-2026-72811	14 Aug 202612:16	–	nvd
osv_ghsa	GHSA-P8CP-78HP-WMQ8 Duplicate Advisory: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle	14 Aug 202612:31	–	osv_ghsa
osv_ghsa	GHSA-Q2VG-7QGX-X5FC SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle	3 Sep 202622:27	–	osv_ghsa

Vulners

CNA

Node

b3log siyuanRange<3.7.4

[
  {
    "vendor": "siyuan-note",
    "product": "siyuan",
    "defaultStatus": "unaffected",
    "packageURL": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "versionType": "semver",
        "lessThan": "3.7.4"
      },
      {
        "version": "3.7.4",
        "status": "unaffected",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/siyuan-before-sql-injection-via-backlink-search
github	www.github.com/siyuan-note/siyuan/security/advisories/GHSA-q2vg-7qgx-x5fc

Parameter	Position	Path	Description	CWE
keyword	query param	/backlink/mention	SQL injection vulnerability in the backlink/mention search query where the client-supplied keyword is concatenated into a SQL MATCH statement without proper escaping of single quotes.	CWE-89

26 Aug 2026 16:56Current

6.4Medium risk

Vulners AI Score6.4

CVSS 49.9

CVSS 3.110

EPSS0.00436

CWE-89