Live › vulnerability › CVE-2026-116171
Go to dashboardOn Windows, SiYuan 3.5.4 before 3.8.7 fails to block paths that use the extended-length prefix (\\?\), so its sensitive-path check misses them. An authenticated API caller can copy workspace config files, including the API token and TLS private keys, into assets that unauthenticated clients can fetch.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Windows installs of SiYuan from 3.5.4 up to but not including 3.8.7 are exposed when an authenticated user can call the import API. Single-user desktop installs where only the owner holds credentials carry much less risk. Non-Windows installs are not described as affected.
No product ranges from the sources yet.
SiYuan --version or check the installed version in the app's About dialog; versions from 3.5.4 up to but not including 3.8.7 are affected3.8.7 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\?) survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the prefix to localPath in /api/import/importStdMd to copy workspace conf files, including the API token and TLS private keys, into assets served to unauthenticated clients.
This page as .md · .json · in your agent: get_signal("CVE-2026-116171")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.