SiYuan CVE-2026-82651

Exploitation requires valid SiYuan administrator credentials - the CVSS vector specifies PR:H, confirming high-privilege authentication is mandatory. The vulnerability targets the /history/*path and /repo/diff/*path HTTP API endpoints specifically, meaning the SiYuan kernel HTTP server must be network-reachable from the attacker. The confidentiality impact on publish-mode passwords is conditional on publish-mode being configured and the publishAccess.json file existing in data/.siyuan/. The guard bypass affects only these two endpoint families; other API routes covered by the original GHSA-c8r8-95hg-mp34 fix are not affected by this specific gap. No user interaction is required. Limiting factors: the PR:H requirement means anonymous or low-privilege attackers cannot exploit this directly; the impact is most severe when publish-mode is actively configured.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N with VC:H) yields a score of 6.9 (Medium), which accurately reflects the privilege barrier: exploitation requires administrator-level authentication, significantly narrowing the attacker pool to insiders, compromised admin credentials, or credential-reuse scenarios. The confidentiality impact is high because publishAccess.json stores publish-mode passwords in plaintext - an admin reading this file obtains credentials that may grant further access beyond SiYuan itself (e.g., to a published site or downstream integrations). No EPSS score is available in the provided data; given the admin-only prerequisite and niche product footprint, real-world opportunistic exploitation is expected to be low. There is no CISA KEV listing and no known public exploit code. The primary real-world risk scenario is a malicious or compromised administrator, or an escalation path where a lower-privilege account somehow gains admin access to SiYuan first. The missing EPSS data and absence of POC mean precise exploitation probability cannot be quantified - treat as a medium-priority finding in environments where SiYuan is deployed with publish-mode enabled.

An attacker with valid SiYuan administrator credentials - obtained via credential stuffing, insider access, or a prior compromise of an admin account - sends an authenticated HTTP GET request to the /history/data/.siyuan/publishAccess.json endpoint. The IsForbiddenAbsPath guard is not invoked for this route, so the server returns the historical file snapshot containing plaintext publish-mode passwords. The attacker then uses those credentials to access the SiYuan publish endpoint or downstream services that reuse those credentials.