CVE-2026-118680 in SiYuaninformazioni

Riassunto

di MITRE • 28/10/2026

SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke importStdMd with a GLOBALROOT-prefixed path to copy the API token and TLS private key into the publicly served assets directory.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsabile

VulnCheck

Prenotare

28/10/2026

Divulgazione

28/10/2026

Moderazione

accettato

EPSS

0.00000

KEV

no

Attività

molto basso

Fonti

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-118680
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-118680
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-118680/

◂ PrecedenteVisione D'ensembleIl prossimo ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!