CVE-2026-116170: medium-severity vulnerability in siyuan-note siyuan
SiYuan before v3.8.7 SQL Injection via History Search op and query
Published
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9
exploitation probability
—
observed exploitation
nono source reports it
SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values. Attackers can send crafted UNION SELECT payloads to searchHistory or getHistoryItems endpoints to exfiltrate deleted document content, titles, and paths.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
siyuan-note · siyuanRelated CVEs — siyuan-note siyuan
In the same product, most dangerous first.
CVE-2026-33476HIGHSiYuan has an Unauthenticated Arbitrary File Read via Path TraversalEPSS 3.1%CVE-2026-54066HIGHSiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)EPSS 2.4%CVE-2026-69084CRITICALSiYuan before v3.7.3 SQL Injection via searchEmbedBlockEPSS 1.6%CVE-2026-69085CRITICALSiYuan before v3.7.3 SQL Injection via searchDocsEPSS 1.5%CVE-2026-34453HIGHSiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked contentEPSS 1.5%CVE-2026-30869CRITICALSiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret LeakageEPSS 1.2%