CVE-2026-85583Medium· 6.5▾ SunlitSiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Last analysed / modified upstream
0.5% → 0.6%
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace and receive the target file bytes, bypassing workspace boundary restrictions.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116166Medium· 6.8SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting
CVE-2026-116167Medium· 6.8SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter
CVE-2026-116168Medium· 6.2SiYuan before v3.8.7 Path Traversal Local File Read via MCP Asset Tool
CVE-2026-116169Medium· 5.4SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks
CVE-2026-116170Medium· 4.9SiYuan before v3.8.7 SQL Injection via History Search op and query
CVE-2026-116171High· 7.5SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix