SiYuan CVE-2026-85175

Network access to the SiYuan HTTP/HTTPS API port is required. On default no-auth-code instances (the out-of-the-box configuration), no credentials are required - any network-reachable client can make the POST /api/file/getFile request. On instances where an access code has been configured, any user who can authenticate is affected, because v3.8.1 assigns RoleAdministrator to every authenticated session, which causes the getFile handler to skip the blocklist entirely. The full cryptographic impact (HTTPS traffic decryption and CA-signed certificate forgery) requires TLS to be enabled on the SiYuan instance (conf/key.pem and conf/ca.key must exist). Instances running on localhost only, without TLS, or isolated from untrusted networks are at significantly reduced risk from the key-material compromise angle, though the file disclosure defect is present in all <=3.8.1 deployments.

The vendor-assigned CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) is largely defensible, with one notable concern: the VA:H (high availability impact on the vulnerable system) component is not directly supported by the description, which identifies no mechanism for service disruption - key compromise forces operational key rotation and certificate revocation, but that is an administrative consequence rather than an availability impact caused by the exploit itself. VC:H and VI:H are well-grounded: exfiltrating the TLS private key enables decryption of captured HTTPS traffic (confidentiality), and exfiltrating the CA key enables signing of fraudulent trusted certificates (integrity). Real-world risk is highest for network-exposed, TLS-enabled SiYuan instances, particularly shared or team deployments. Default no-auth-code configurations effectively remove even the PR:L barrier, making exploitation trivially easy for any network-adjacent attacker - closer to PR:N than the vector implies. EPSS data was not provided; the vulnerability is not listed in CISA KEV; no public proof-of-concept code has been identified. Self-hosted, localhost-only, or non-TLS deployments face reduced cryptographic risk but remain vulnerable to file disclosure.

An attacker connected to the network hosting a SiYuan v3.8.1 instance - with either a valid session or no credentials on a default no-auth-code deployment - sends a single POST request to /api/file/getFile specifying the path conf/key.pem; the incomplete blocklist passes the request, and because the handler treats the caller as RoleAdministrator it returns the raw TLS private key. The attacker repeats the request for conf/ca.key, then uses the recovered private key to decrypt previously captured TLS-encrypted sessions between SiYuan and its users, and uses ca.key to sign malicious certificates that client browsers already trust.