EUVD-2026-70410
GHSA-gg9w-4vv2-vjcm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible POST endpoint; low privilege (any authenticated user, effectively none on default no-auth instances); C:H for key disclosure, I:H for CA forgery; A:N as no availability impact mechanism is described.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan's CA (ca.key).
AnalysisAI
TLS private key disclosure in SiYuan <=3.8.1 allows any authenticated user - or any network client on default no-auth-code deployments - to exfiltrate the server's TLS private key (conf/key.pem) and CA private key (conf/ca.key) via a simple POST to /api/file/getFile. The root cause is a dual flaw: the IsForbiddenAbsPath() blocklist covers only conf/conf.json by exact match while leaving sibling key material unprotected, and the getFile handler unconditionally skips the blocklist for RoleAdministrator - a role granted to every authenticated user in v3.8.1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Network access to the SiYuan HTTP/HTTPS API port is required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) is largely defensible, with one notable concern: the VA:H (high availability impact on the vulnerable system) component is not directly supported by the description, which identifies no mechanism for service disruption - key compromise forces operational key rotation and certificate revocation, but that is an administrative consequence rather than an availability impact caused by the exploit itself. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is upgrading to SiYuan v3.8.2, which corrects the incomplete blocklist in IsForbiddenAbsPath() to include conf/key.pem and conf/ca.key, per GitHub Security Advisory GHSA-4wwp-f6gw-6qm5 (https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4wwp-f6gw-6qm5). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SiYuan deployments running version 3.8.1 or earlier and assess network exposure, prioritizing TLS-enabled instances; implement network-level access restrictions (VPN, IP allowlisting) for critical deployments if immediate patching is not feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), t
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. R
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated criti
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated c
SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code ex
Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chro
Reflected XSS in SiYuan knowledge management before 3.5.9.
SiYuan knowledge management system prior to 3.5.5 has a path traversal in /api/file/copyFile allowing arbitrary file ope
SiYuan version 3.0.3 allows executing arbitrary commands on the server. Rated critical severity (CVSS 9.0), this vulnera
SQL injection in SiYuan prior to version 3.6.0 allows any authenticated user, including those with read-only access, to
Cross-site scripting (XSS) in SiYuan personal knowledge management system versions 3.6.0-3.6.1 allows remote attackers t
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today