Live › vulnerability › CVE-2026-116170
Go to dashboardSiYuan before v3.8.7 fails to escape the op and type query values sent to its history endpoints, so SQL injection is possible. An attacker holding the admin token can use crafted UNION SELECT payloads to read history.db, exposing deleted document content, titles and paths.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams that run SiYuan on a server or share its API with others, where the admin token is held by more than one person or service. Single-user desktop installs where only the owner holds the token are much less exposed. unknown whether other configurations are affected beyond this.
No product ranges from the sources yet.
3.8.7; anything older is in scope.v3.8.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values. Attackers can send crafted UNION SELECT payloads to searchHistory or getHistoryItems endpoints to exfiltrate deleted document content, titles, and paths.
This page as .md · .json · in your agent: get_signal("CVE-2026-116170")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.