CVE-2026-85174
Received Received - Intake

SiYuan Plaintext API Token Logging Leading to Admin Access

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85174
EUVD
EUVD-2026-70409

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.8.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access.

Detection Guidance

Check if the log file /temp/siyuan.log exists and inspect it for plaintext API tokens in query parameters. Use commands like 'ls -la /temp/siyuan.log' to locate the file and 'cat /temp/siyuan.log' to view its contents for exposed tokens.

Impact Analysis

Authenticated attackers can exploit this to recover admin API tokens and gain permanent administrative access to all API endpoints. The vulnerability allows unauthorized access to sensitive data and system control.

Mitigation Strategies

Upgrade SiYuan to version 3.8.2 or later to apply the fix. Rotate all exposed API tokens immediately to prevent unauthorized access. Ensure the log file path is added to the forbidden list to block access via the getFile endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85174. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart