CVE-2026-85175
Received Received - Intake

Information Disclosure in SiYuan

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan's CA (ca.key).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85175
EUVD
EUVD-2026-70410

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.8.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-552 The product makes files or directories accessible to unauthorized actors, even though they should not be.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan versions 3.8.1 and earlier have a flaw in the IsForbiddenAbsPath() function that only blocks one specific file (conf/conf.json) but fails to restrict access to sensitive private keys (conf/key.pem and conf/ca.key) stored in the same directory. Due to a role assignment issue, all authenticated users receive administrator privileges, allowing them to retrieve these private keys via a specific API endpoint (POST /api/file/getFile).

Detection Guidance

Check SiYuan versions <= 3.8.1 by inspecting the application version or installation directory. Monitor POST /api/file/getFile requests for unauthorized access to conf/key.pem or conf/ca.key files. Verify if RoleAdministrator permissions are granted to unintended users.

Impact Analysis

If you use SiYuan with TLS enabled, attackers can steal the private key (key.pem) to decrypt your HTTPS traffic. They can also forge certificates using the CA private key (ca.key), tricking clients that trust SiYuan's CA into accepting malicious certificates. This affects confidentiality, integrity, and authenticity of communications.

Compliance Impact

This vulnerability likely violates GDPR (data confidentiality) and HIPAA (protected health information integrity) by exposing sensitive data (HTTPS traffic) to unauthorized decryption and enabling certificate spoofing attacks that could facilitate phishing or man-in-the-middle attacks.

Mitigation Strategies

Upgrade SiYuan to version 3.8.2 or later to address the incomplete blocklist issue. Restrict access to the conf/ directory and ensure only authorized users have RoleAdministrator permissions. Disable default no-auth-code instances if applicable.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85175. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart