CVE-2026-85175 Details
Description
SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan's CA (ca.key).
A vulnerability exists in SiYuan versions through 3.8.1, where an incomplete blocklist in the IsForbiddenAbsPath() function allows unauthorized access to TLS private keys. The function only blocks the conf/conf.json file by exact match, leaving the TLS private key (conf/key.pem) and CA private key (conf/ca.key) unprotected. All authenticated users receive RoleAdministrator in v3.8.1, enabling them to retrieve these private keys via the POST /api/file/getFile endpoint. On deployments with TLS enabled, possession of key.pem allows decryption of captured HTTPS traffic, while ca.key can be used to forge certificates trusted by clients that imported SiYuan's CA.
Users should update to SiYuan version 3.8.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4wwp-f6gw-6qm5 | CISA-ADP | AdvisoryExploitVendor |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4wwp-f6gw-6qm5 | [email protected] | AdvisoryExploitVendor |
| https://www.vulncheck.com/advisories/siyuan-before-3.8.2-tls-private-key-disclosure-via-getfile | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-552 | Files or Directories Accessible to External Parties | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SiYuan | <= 3.8.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | New CVE Received | [email protected] |
| Sep 3, 2026 | CVE Modified | CISA-ADP |