CVE-2026-85175 in SiYuan
Summary
by MITRE • 09/03/2026
SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan's CA (ca.key).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability in SiYuan versions prior to 3.8.2 represents a critical failure in access control logic within the file retrieval mechanism, specifically stemming from an incomplete blocklist implementation in the IsForbiddenAbsPath function located in kernel/util/path_guard.go. This security flaw allows authenticated users, including those with administrative privileges or any user on instances configured without authentication codes, to bypass intended restrictions and retrieve sensitive cryptographic material stored in the application's configuration directory. The core technical deficiency lies in the fact that the blocklist only performs an exact match against conf/conf.json, thereby failing to restrict access to other critical files such as TLS private keys (conf/key.pem) or Certificate Authority private keys (conf/ca.key). This oversight creates a significant gap in data protection for sensitive configuration assets.
From an operational perspective, this vulnerability enables unauthorized actors to extract the server's TLS private key and the CA private key through POST requests directed at the /api/file/getFile endpoint. The severity of this issue is compounded by the authentication model present in version 3.8.1, where all authenticated users are automatically assigned RoleAdministrator privileges. Consequently, even on instances with basic authentication enabled, any valid user can exploit this flaw. On default installations that do not require an authentication code, the vulnerability is effectively exploitable by anyone who can reach the application interface without prior credentials. This lack of proper privilege separation means that low-privileged users or unauthenticated attackers have direct access to high-sensitivity data.
The impact of successfully exploiting this vulnerability extends beyond simple information disclosure. If TLS encryption is enabled on the deployment, an attacker possessing the extracted key.pem file can perform man-in-the-middle attacks by decrypting captured HTTPS traffic between clients and the SiYuan server. This compromises the confidentiality and integrity of all communications passing through the application. Furthermore, if clients have imported the SiYuan CA certificate into their trust store, possession of ca.key allows an attacker to forge new certificates that will be trusted by these clients. This capability facilitates sophisticated phishing attacks or further interception of secure connections without triggering security warnings in standard web browsers or client applications.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-538 Insertion of Sensitive Information into Log File, although the latter is more applicable to the storage aspect; primarily it reflects a failure in enforcing least privilege principles where administrative functions are accessible to non-administrative roles due to flawed role assignment logic. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1530 Data from Local System which involves accessing data stored on local systems, and potentially T1462 Modified Security Checks if the blocklist bypass is considered a security check modification. The exploitation also relates to T1078 Valid Accounts as it relies on valid authentication credentials or lack thereof in default configurations.
To mitigate this vulnerability, organizations running SiYuan versions up to 3.8.1 must immediately upgrade to version 3.8.2 or later where the blocklist has been corrected to include all sensitive files within the conf directory regardless of exact filename matches. Additionally, administrators should review their authentication settings and ensure that RoleAdministrator privileges are not inadvertently granted to standard users in future updates if such a configuration is maintained. It is also recommended to rotate any TLS keys and CA certificates that may have been exposed during the period when the vulnerability was present on production systems. Regular audits of file access controls and strict adherence to principle of least privilege for API endpoints are essential practices to prevent similar access control failures in web applications.