CVE-2026-85583
Received Received - Intake

SiYuan Path Traversal in File-Read Endpoint

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace and receive the target file bytes, bypassing workspace boundary restrictions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85583
EUVD
EUVD-2026-71006

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.8.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan versions before v3.8.2 have a path traversal vulnerability in the file-read endpoint. When a reader requests a file under data/assets/ that is a symlink pointing outside the workspace, the endpoint follows the symlink and returns the target file's contents. This bypasses workspace boundaries and allows low-privilege users to access unauthorized files if reachable via symlinks.

Detection Guidance

To detect this vulnerability, inspect SiYuan installations for versions before v3.8.2. Check for symlinks in data/assets/ pointing outside the workspace. Review API logs for unauthorized file access attempts by reader-role users. No specific commands are provided in the resources.

Impact Analysis

Attackers with reader access can access sensitive files outside the workspace by exploiting symlinks. This may lead to unauthorized data disclosure, though filesystem permissions and sensitive-path filters may limit the impact. The vulnerability allows reading files the attacker should not have access to.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing personal or confidential information. Compliance may be impacted if unauthorized data access occurs.

Mitigation Strategies

Upgrade SiYuan to v3.8.2 or later. Implement symlink resolution checks before file access. Ensure resolved paths remain within the workspace. Apply sensitive-path filters to resolved paths. Restrict reader-role permissions to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85583. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart