PT-2026-123011

CVE-2026-116170

Published

2026-10-25

Updated

2026-10-25

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.7

Description An SQL injection issue allows users with an admin-token to read the history.db database. This occurs when unescaped values are provided for the op and type=3 query parameters. By sending crafted UNION SELECT payloads to the 'searchHistory' and 'getHistoryItems' endpoints, an attacker can exfiltrate titles, paths, and content of deleted documents.

Recommendations Update to version 3.8.7 or later. As a temporary mitigation, restrict access to the 'searchHistory' and 'getHistoryItems' endpoints.

Exploitability

Exploit

Fix

Impacts

Researchers

Alienkeric

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers

CVE-2026-116170