SiYuan CVE-2026-85174

Exploitation requires a valid low-privilege authenticated session on the target SiYuan instance (CVSS PR:L). The attacker must be able to submit full-text search API requests that trigger the application's internal slow-query timing threshold; this condition can be influenced by search query design or induced by server load and does not require a specific non-default configuration setting. The getFile endpoint must be reachable from the attacker's account, which is a default capability for authenticated users. No special deployment mode or feature flag is required - any multi-user SiYuan deployment before v3.8.2 where authenticated users can access both the search and getFile APIs is vulnerable. Exploitation is strictly limited to actors who already possess valid account credentials; unauthenticated network attackers cannot exploit this vulnerability without first compromising an account.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately reflects the threat model: the attack is network-reachable, requires no special configuration, and demands only a low-privilege account. Even a mid-sized municipal IT team in legnica running a shared SiYuan instance should treat this as urgent, given that any team member with a valid account can recover admin credentials and gain permanent administrative control. The primary real-world limiting factor is the PR:L authentication requirement - the attacker must already hold a valid credential - which meaningfully reduces the threat surface compared to a fully unauthenticated flaw. No CISA KEV listing exists, and no public exploit code has been identified at time of analysis, but the attack path is mechanically straightforward once credentials are obtained: trigger a slow search, retrieve the log, extract the token. EPSS data is not available in the provided input; exploitation feasibility is inferred from the CVSS vector and attack description.

An attacker with a low-privilege SiYuan account crafts or waits for full-text search queries that exceed the application's internal timing threshold, causing the admin API token to be appended in plaintext to the application log file. The attacker then calls the getFile endpoint - accessible to any authenticated user - to download the log, parses it for the token string, and uses the recovered admin token to perform unrestricted administrative operations against the instance. No public exploit code has been identified at time of analysis, but the technique requires no specialized tooling given the straightforward log-retrieval path.