4.9
MediumCVSS 3.1 · from VulnCheck
CVE-2026-116170
SiYuan before v3.8.7 SQL Injection via History Search op and query
siyuan · SQL injection · CWE-89Affectedsiyuan
FixUpdate to 3.8.7 or newer
PublishedOct 25, 13:20 · VulnCheck
ScoredOct 25 · 4.9 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
A successful attack can read data. CVSS impact.
Description
SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values. Attackers can send crafted UNION SELECT payloads to searchHistory or getHistoryItems endpoints to exfiltrate deleted document content, titles, and paths.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed insiyuanbefore 3.8.73.8.7siyuanNot affected3.8.7
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known