CVE-2026-116170: SiYuan before v3.8.7 SQL Injection via History Search op and query

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-25 · updated 2026-10-29
Weakness: CWE-89

Description

SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values. Attackers can send crafted UNION SELECT payloads to searchHistory or getHistoryItems endpoints to exfiltrate deleted document content, titles, and paths.

Affected products

siyuan-note siyuan: before 3.8.7 — fixed in 3.8.7

How to fix

Upgrade to a fixed version: siyuan-note siyuan 3.8.7. Check the vendor advisory for mitigations.

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4hjx-84f6-gr7c
https://www.vulncheck.com/advisories/siyuan-before-3.8.7-sql-injection-via-history-search-op-and-query
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4hjx-84f6-gr7c

Get alerted when CVE-2026-116170 or the next vulnerability affects your stack