Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-116170: SiYuan lets admin token extract deleted notes
CVE-2026-116170 · published 10 days ago
Summary
In versions of SiYuan before 3.8.7, someone who has an admin token can use the history search feature to pull data from the internal history database. This can reveal the contents, titles, and locations of documents that users thought were deleted. Upgrade SiYuan to version 3.8.7 or later, and limit the distribution of admin tokens to trusted personnel.
What to do
- Update siyuan-note siyuan to version 3.8.7 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| siyuan-note | siyuan | < 3.8.7 |
Original advisory text
SiYuan before v3.8.7 SQL Injection via History Search op and query
SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values. Attackers can send crafted UNION SELECT payloads to searchHistory or getHistoryItems endpoints to exfiltrate deleted document content, titles, and paths.
References
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4hjx-84f6-gr7c Vendor Advisory
- https://www.vulncheck.com/advisories/siyuan-before-3.8.7-sql-injection-via-histo... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-1161... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-116170 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-89SQL Injection
Timeline
Published25 Oct 2026
Updated4 Nov 2026
First seen25 Oct 2026
Sources
CVE-2026-116170 · NVD
CVE-2026-116170 · MITRE
CVE-2026-116170 · OSV
GHSA-4hjx-84f6-gr7c · GHSA
Track software like this
Free during beta