CVE-2026-82651 | BDVDB-2026-366379 Detail

Description#

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can retrieve historical snapshots of sensitive files that the guard is meant to block, including data/.siyuan/publishAccess.json (plaintext publish-mode passwords) and files under data/templates/.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-30Record published in the CVE List.
2. Version 22026-08-31Most recent update recorded in the CVE List.