SiYuan versions before 3.7.3 contain a SQL injection vulnerability in the /api/filetree/searchDocs endpoint due to direct concatenation of user-supplied keyword parameters into SQL statements without escaping or parameter binding. Attackers can exploit this by crafting malicious input to execute arbitrary SQL commands. The vulnerability is reachable via a publish RoleReader token or unauthenticated if publish mode is enabled with 'Publish.Auth.Enable' set to false. The SQLite driver used supports stacked statements (semicolon-separated), enabling attackers to read and modify database content across all cleartext notebooks. This allows full database compromise, including data exfiltration, modification, or deletion. The CVSS score of 10.0 reflects the severity of unrestricted read/write access and potential for unauthenticated exploitation. Immediate remediation requires upgrading to SiYuan v3.7.3 or later. Users should also disable publish mode if not required and implement strict input validation for all endpoints. Organizations leveraging affected versions are strongly advised to apply patches and monitor for suspicious database activity.