VULNERABILITY INTELLIGENCE
CVE-2026-116170
CVSS score4.9 MEDIUM
EPSS probability0.36%
CISA KEVNot currently listed
Published2026-10-25
Last modified2026-10-29
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Description
SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values. Attackers can send crafted UNION SELECT payloads to searchHistory or getHistoryItems endpoints to exfiltrate deleted document content, titles, and paths.
Weakness classification
- disclosure@vulncheck.com: CWE-89