Technical impact
SiYuan before version 3.8.7 includes a SQL injection flaw that allows an attacker who possesses an admin-token to embed malicious SQL in the unescaped 'op' and 'type=3' query parameters sent to the searchHistory or getHistoryItems endpoints. By supplying crafted UNION SELECT payloads, the attacker can retrieve data from the history.db file, exposing deleted document content, titles, and paths. The vulnerability directly leaks confidential information stored in the application’s audit trail and does not rely on additional privileges beyond those granted to a valid administrator.
Affected Systems
The affected product is the SiYuan note‑taking application made by Siyuan‑Note. Versions earlier than 3.8.7 are vulnerable; any deployment with an active admin-token on those releases is susceptible.
Risk and Exploitability
The CVSS score of 6.9 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires possession of an admin-token and involves sending crafted HTTP requests to the searchHistory or getHistoryItems API endpoints, which can be performed with low effort once the privileged token is in hand. The result is potentially full exposure of deleted document metadata and content, constituting a significant confidentiality risk.
