Is CVE-2026-116170 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116170?

CVE-2026-116170 has a CVSS v3 severity of MEDIUM (4.9).

Back

CVE-2026-116170

Description

SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values. Attackers can send crafted UNION SELECT payloads to searchHistory or getHistoryItems endpoints to exfiltrate deleted document content, titles, and paths.