CVE-2026-85174 in SiYuan
Summary
by MITRE • 09/03/2026
SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in SiYuan versions prior to 3.8.2 represents a critical information disclosure flaw rooted in improper logging practices within the application's full-text search functionality. When users initiate full-text search requests, the system processes these queries through specific API endpoints that accept parameters via HTTP query strings. Under normal operational conditions, this process functions without issue; however, when a request exceeds predefined timing thresholds, indicating potential latency or performance bottlenecks, the software triggers an internal logging mechanism to record diagnostic information. This mechanism inadvertently captures sensitive data embedded within the URL's query parameters, specifically API tokens used for authentication and authorization purposes. Instead of sanitizing these inputs before persistence, the application writes them in plaintext directly into accessible log files stored on the server filesystem.
This technical flaw aligns with CWE-532, which classifies information exposure through log files as a significant security risk. The core issue lies in the failure to redact or hash sensitive credentials such as API tokens before they are written to disk. By including these tokens in plaintext within logs that track performance metrics for slow queries, SiYuan creates an unintended data leakage channel. This behavior violates fundamental principles of secure software design regarding the handling of secrets and authentication materials, where even transient exposure during error or diagnostic logging can lead to severe compromise if the storage medium is not strictly protected against unauthorized access.
The operational impact of this vulnerability is profound due to its potential for permanent administrative takeover by authenticated attackers. While initial access requires valid credentials, the scope of privilege escalation available through this flaw allows an attacker with any level of authentication to escalate their privileges significantly. By leveraging the getFile endpoint, which is designed to allow users to retrieve documents and assets stored within SiYuan, an attacker can navigate to the directory containing these log files. Since the logs are not restricted by file system permissions that would prevent access by authenticated user accounts, the attacker can download or view the contents of the log file. Upon extraction, they recover the plaintext API tokens associated with high-privilege administrative sessions logged during previous slow queries. Possession of an admin-level API token grants the attacker full control over the instance, enabling them to read all data, modify configurations, and potentially execute further attacks without needing additional authentication steps in many contexts where these tokens are accepted as valid proof of identity.
This exploitation path is consistent with ATT&CK technique T1078, specifically Valid Accounts, combined with T1530, Data from Local System, as the attacker utilizes legitimate credentials to access local system resources (log files) for data exfiltration. The ability to recover tokens via a standard file retrieval endpoint underscores a critical misconfiguration in both application logic and server-side security controls. It demonstrates how internal diagnostic features can be repurposed by adversaries to bypass authentication mechanisms entirely, turning routine operational logs into a treasure trove of credentials that persist long after the initial session has ended.
Mitigation strategies must focus on immediate remediation of the logging mechanism and broader architectural reviews. The primary fix involves updating SiYuan to version 3.8.2 or later, where this specific logging behavior regarding query parameters in full-text search requests has been corrected to exclude sensitive data from plaintext logs. For environments unable to update immediately, administrators should manually review log directories for any exposed tokens and rotate all affected API keys and passwords immediately. Furthermore, it is essential to implement strict file system permissions on server-side log files so that they are not readable by standard authenticated user accounts but only by the service account running the application or a dedicated security monitoring process. Implementing input validation and output encoding practices within the logging module will prevent future occurrences of similar information disclosure vulnerabilities across other endpoints in the application.