SiYuan kernel CVE-2026-116171

Requires a Windows SiYuan install (kernel 3.5.4 through 3.8.6) because the exploit relies on the Windows NT extended-length prefix \\?\ surviving filepath.Clean as a volume name. The attacker must reach the kernel HTTP API (default 127.0.0.1:6806) and call /api/import/importStdMd with localPath pointing at the workspace conf directory via the \\?\ prefix; then retrieve the copied files through unauthenticated GET /assets/ URLs. Limiting factors: the advisory describes the caller as authenticated (though in default local mode with no lock-screen/access-auth-code the kernel accepts local requests without a token), the API must be reachable by the attacker, only denylist-only endpoints (importStdMd, copyExportFile) are affected while IsSubPath-guarded endpoints such as /export/ are immune, and the flaw does not apply to non-Windows builds.

Signals are moderately strong but partly conflicting. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) scores 8.7 and models remote, low-complexity, unauthenticated exploitation with high confidentiality impact. However, the description and GHSA advisory both say 'Authenticated API callers' - so the PR:N in the input is in direct tension with the prose, and the auth requirement is unresolved (verify with vendor). The PoC further notes the kernel trusts local callers without a token only when no lock-screen/access-auth-code is set, so 'unauthenticated' holds mainly for local or auth-disabled deployments rather than a token-protected remote API. No EPSS score was provided (missing, not low), and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation. Against that, a detailed public proof-of-concept is published in the GHSA advisory and was confirmed working end-to-end at runtime by the reporter (VulnCheck), and the vuln.today decision label is 'this_week'. Net: this is a credible, verified confidentiality-disclosure flaw (API token and TLS private keys exfiltrated to unauthenticated asset URLs) that warrants prompt patching, but its real-world blast radius is tempered by Windows-only applicability, the need to reach the kernel API, the authenticated-caller qualifier, and the product's niche footprint - more a targeted-opportunity issue than a mass-exploitation emergency.

An attacker able to call the SiYuan kernel HTTP API on a Windows host sends POST /api/import/importStdMd with localPath set to the workspace conf directory prefixed with the NT extended-length prefix (\\?\), which survives filepath.Clean and bypasses the IsSensitivePath denylist. The kernel copies conf.json (API token, accessAuthCode) and TLS material (key.pem, cert.pem, ca.key) into data/assets/, which the attacker then retrieves via unauthenticated GET /assets/ requests. A reporter-confirmed public PoC for this exact flow is published in the GHSA advisory.