SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

What happened?

Summary The /api/filetree/searchDocs endpoint concatenates the caller-supplied search keyword directly into a SQL statement with no escaping and no parameter binding. The endpoint is gated by CheckAuth only reachable by the publish RoleReader token, and by the anonymous account when Publish.Auth.Enable is false. The resulting statement runs on a read-write SQLite handle through a driver that executes stacked (;-separated) statements, against the global blocks table spanning all

Key details

• The /api/filetree/searchDocs endpoint concatenates user-supplied search keywords directly into SQL without escaping or parameter binding.
• The endpoint is reachable by unauthenticated users when Publish.Auth.Enable is false or by any publish RoleReader token.
• The vulnerable query targets the global blocks table spanning all opened non-encrypted notebooks, enabling cross-notebook read and write.
• Existing statement guards CheckSingleStatement and CheckReadonlyStatement are not called on the searchDocs query path.
• A proof of concept demonstrates unauthenticated SQL injection disclosing sqlite_version() via UNION SELECT through the search response.

Summarised by SecOraLens from GitHub Security Advisories. Always read the original source before acting. How SecOraLens verifies advisories.