SiYuan CVE-2026-59854

Exploitation requires an authenticated session with administrator-level privileges or a valid SiYuan API token - PR:H per the CVSS vector. The attacker must be able to reach the POST /api/file/globalCopyFiles endpoint over the network (AV:N), which in default SiYuan deployments is typically bound to localhost or a local network interface. Exploitation is limited by: (1) the requirement for admin or API-token authentication; (2) the target files must exist at predictable paths on the host filesystem; (3) the SiYuan process must have read permission for the target credential files, which depends on the OS user running SiYuan. In containerized deployments where host directories are volume-mounted, the accessible credential file surface may be larger. No special application feature flag or non-default configuration is required beyond having a running SiYuan instance with API access - the vulnerable endpoint is part of the default API surface.

The CVSS 3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) accurately characterizes this vulnerability. The PR:H rating is critical context - exploitation is gated on administrative access or a valid API token, which materially limits the attacker pool. However, C:H reflects the real impact: once those credentials are obtained, an attacker can pivot laterally into Kubernetes clusters, Docker registries, PostgreSQL databases, and Git-hosting accounts, effectively using SiYuan as a credential harvesting relay. No EPSS data was provided in the input and this CVE is not in the CISA KEV catalog, meaning no confirmed active exploitation. The 'Docker' tag in the source intelligence is operationally significant: containerized SiYuan deployments with home-directory mounts are especially exposed because cloud-provider credential files (e.g., ~/.aws, ~/.gcloud) may also be reachable, even though not explicitly named in the advisory. The real-world risk is moderate-to-high in privilege-escalation chains but low as a standalone initial access vector, because it requires prior admin-level authentication.

An attacker who has obtained SiYuan administrator credentials or a valid API token - through phishing, credential reuse, or insider access - sends a POST request to /api/file/globalCopyFiles specifying an absolute path such as /root/.kube/config or /home/user/.docker/config.json as the source. The incomplete denylist allows the copy to proceed, placing the credential file inside the SiYuan workspace directory. The attacker then retrieves the file contents via SiYuan's file-serving API, gaining Kubernetes or Docker registry credentials without requiring any direct filesystem access. No public proof-of-concept code has been identified, but the attack requires only knowledge of standard credential file paths.