Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

SiYuan before 3.8.1 lets attacker read private files

CVE-2026-82650 · published 2 months ago
Summary

Versions of SiYuan prior to 3.8.1 allow a logged‑in user to request a special API endpoint and trick the system into showing files from anywhere in the workspace, including configuration files that hold the API token and signing keys. This could let someone who gains access to an account view sensitive data. Upgrade to version 3.8.1 or later to stop the issue.

What to do
  • Update siyuan-note siyuan to version 3.8.1 or later.
Affected software
VendorProductAffected versions
siyuan-note siyuan < 3.8.1
Original advisory text
SiYuan before v3.8.1 Path Traversal via /api/template/render
SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function (kernel/model/template.go), reachable via the POST /api/template/render endpoint (kernel/api/template.go). The endpoint restricts the supplied path only to the workspace directory (util.IsAbsPathInWorkspace) but, unlike the file API's refuseToAccess() blocklist, applies no sensitive-path exclusion. This allows an authenticated attacker to read sensitive workspace files, including conf/conf.json, which contains the API token and cookie signing key. The issue is fixed in v3.8.1.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-668Exposure of Resource to Wrong Sphere
Timeline
Published30 Aug 2026
Updated4 Nov 2026
First seen30 Aug 2026
Sources
CVE-2026-82650 · NVD
CVE-2026-82650 · MITRE
CVE-2026-82650 · OSV
GHSA-9jfx-rc58-h23j · GHSA
Track software like this
Free during beta