Live › vulnerability › CVE-2026-118680
Go to dashboardSiYuan 3.8.7 through 3.8.8 does not normalize Windows GLOBALROOT device-namespace paths, so its sensitive-path denylist can be bypassed. An attacker who can call importStdMd can copy the API token and TLS private key into the publicly served assets directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Windows installations of SiYuan 3.8.7 through 3.8.8 are affected, especially where the API is reachable from other machines or the internet. Desktop-only use on a locked-down machine carries less exposure. Installations on other operating systems are not described as affected.
No product ranges from the sources yet.
3.8.7 through 3.8.8 are affected.3.8.8 (fixed version unknown from the sources).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke importStdMd with a GLOBALROOT-prefixed path to copy the API token and TLS private key into the publicly served assets directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-118680")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.