CVE-2026-85583 in SiYuan
Summary
by MITRE • 09/04/2026
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace and receive the target file bytes, bypassing workspace boundary restrictions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in SiYuan versions prior to v3.8.2 represents a critical path traversal flaw within the application's reader-accessible file-read endpoint. This security defect stems from an insufficient validation mechanism when handling asset paths that are designated as authorized for access by users with the reader role. Specifically, the software fails to adequately sanitize or resolve symbolic links before processing requests for files located under the data/assets/ directory structure. When a user submits a request targeting a logical asset path, the application resolves this path and subsequently follows any symbolic links present in that location without verifying whether the ultimate target resides within the permitted workspace boundaries. This behavior allows an attacker to construct a malicious request where the specified asset is actually a symlink pointing to a file system resource outside of the designated SiYuan workspace directory.
From a technical perspective, this flaw constitutes a classic Path Traversal vulnerability, often categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory in industry standards such as the Common Weakness Enumeration database. The root cause lies in the application's trust model regarding file system operations; it assumes that if a path is accessible via the reader role and resides within the assets directory, its contents are safe to serve. However, by blindly following symbolic links during the file read operation, the software inadvertently bypasses these logical boundaries. This allows for unauthorized data exfiltration, as an authenticated user with low-privilege access can retrieve sensitive files from arbitrary locations on the host system where SiYuan is installed. The impact extends beyond simple information disclosure, potentially exposing configuration files, private documents, or other critical system resources that were intended to remain isolated within the application's sandboxed environment.
The operational impact of this vulnerability is significant for any deployment relying on role-based access control to segregate data between different user tiers. An attacker leveraging this flaw can read arbitrary files from the server's file system, leading to a severe compromise of confidentiality. Depending on the permissions under which the SiYuan service runs, an adversary might gain access to database credentials, environment variables containing secrets, or other internal application logic that could facilitate further attacks such as remote code execution or privilege escalation. This undermines the fundamental security principle of least privilege and data isolation, rendering the role-based restrictions ineffective against determined adversaries who understand file system mechanics.
To mitigate this vulnerability, it is imperative to upgrade SiYuan to version v3.8.2 or later, where the developers have implemented proper safeguards to prevent following symbolic links outside the workspace directory during asset retrieval operations. In environments where upgrading is not immediately feasible, administrators should enforce strict operating system-level permissions on the data/assets/ directory and its contents, ensuring that sensitive files are stored in locations inaccessible via symlinks from within the assets folder. Additionally, implementing a web application firewall rule to detect and block requests containing path traversal patterns or symbolic link indicators can provide an additional layer of defense. Regular security audits focusing on file system access controls and input validation for all endpoints handling user-supplied paths are recommended to prevent similar issues in future development cycles.