CVE-2026-116170: SiYuan before v3.8.7 SQL Injection via History Search op and query

Q: Who can exploit this vulnerability?

An attacker needs a SiYuan admin token. The issue is remotely reachable, but it does not allow an unauthenticated attacker to exploit the affected history-search endpoints.

Q: What data could be exposed?

Successful exploitation can read data from history.db, including deleted document content, document titles, and paths. Integrity and availability impact are not indicated by the provided severity vector.

Q: Which requests are affected?

The affected functionality is exposed through the searchHistory and getHistoryItems endpoints. Exploitation uses crafted UNION SELECT payloads in unescaped op and type=3 query values.

Q: How can I determine whether an instance is affected?

SiYuan versions before v3.8.7 are affected. Instances at or above v3.8.7 are not identified as affected by the provided information.

Published Oct 25, 2026

Updated

SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values. Attackers can send crafted UNION SELECT payloads to searchHistory or getHistoryItems endpoints to exfiltrate deleted document content, titles, and paths.

Affected Software

1 affected component

SiYuan SiYuan<3.8.7

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker needs a SiYuan admin token. The issue is remotely reachable, but it does not allow an unauthenticated attacker to exploit the affected history-search endpoints.

What data could be exposed?

Successful exploitation can read data from history.db, including deleted document content, document titles, and paths. Integrity and availability impact are not indicated by the provided severity vector.

Which requests are affected?

The affected functionality is exposed through the searchHistory and getHistoryItems endpoints. Exploitation uses crafted UNION SELECT payloads in unescaped op and type=3 query values.

How can I determine whether an instance is affected?

SiYuan versions before v3.8.7 are affected. Instances at or above v3.8.7 are not identified as affected by the provided information.

CVE-2026-116170: SiYuan before v3.8.7 SQL Injection via History Search op and query

Affected Software

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What data could be exposed?

Which requests are affected?

How can I determine whether an instance is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What data could be exposed?

Which requests are affected?

How can I determine whether an instance is affected?