CVE-2026-85175High· 8.8▾ Twilight

SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score48/ 100 · Moderate

impact 48.4 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 3, 2026

Updated

Sep 8, 2026

CVSS

8.8

Vendor

siyuan-note

Product

github.com/siyuan-note/siyuan/kernel

CWE

CWE-552

Depth score

48 · Moderate

EPSS

0.33% · p25

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Sep 8.

0.2% → 0.3%▲ 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 22 days

Sep 3, 2026Published
Disclosed via NVD
Sep 8, 2026Record revised
Last analysed / modified upstream
Sep 8, 2026EPSS first tracked
0.2%
Sep 25, 2026EPSS peak
0.2% → 0.3%

siyuan-note CWE-552 #nvd #osv #go

Affected

github.com/siyuan-note/siyuan/kernel < 0.0.0-20260819144130-256d73aa7f94

Patched in

github.com/siyuan-note/siyuan/kernel 0.0.0-20260819144130-256d73aa7f94

Full technical detail▾

Overview

SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan's CA (ca.key).

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Package advisory (CVE-2026-85175)

Affected packages:

github.com/siyuan-note/siyuan/kernel < 0.0.0-20260819144130-256d73aa7f94

Patched in:

github.com/siyuan-note/siyuan/kernel 0.0.0-20260819144130-256d73aa7f94

Source: https://osv.dev/vulnerability/GHSA-4wwp-f6gw-6qm5

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#osv#go

← Back to feed