SiYuan versions prior to v3.7.3 contain a critical SQL injection vulnerability (CVE-2026-72811) in the backlink/mention search functionality. The vulnerability arises from improper sanitization of client-supplied search keywords and stored document metadata (titles, aliases, anchor text) when constructing SQL MATCH queries. While double-quote characters are escaped, single quotes remain unvalidated, enabling attackers to inject malicious SQL payloads. This flaw is exploitable via first-order attacks (direct user input) accessible to anonymous or read-only users, as well as second-order attacks leveraging maliciously crafted metadata stored in documents. Successful exploitation could allow database enumeration, data exfiltration, or remote code execution with the privileges of the SiYuan process. The CVSS score of 10.0 reflects the vulnerability's high severity, as it requires minimal user interaction and impacts confidentiality, integrity, and availability. Immediate remediation is recommended by upgrading to SiYuan v3.7.3 or later, which addresses the input sanitization flaw in the affected query logic.