CVE-2026-126264 · Package
NO FIX YET · SEE WHAT TO DO
SiYuan before 3.8.9 lets an authenticated user with the Reader role fetch credential-named widget files, such as credentials.json, by getting around the sensitive-path check in getFile. An attacker can collect API keys, tokens, and other stored secrets from those files.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host SiYuan with multiple users, where some accounts have the Reader role and widgets store credentials in credentials.json files. Single-user installs with no Reader accounts have a much smaller exposure.
Not affected if no-reader-accounts, single-user, version-3.8.9-or-later
Who cares self-hosted, siyuan, widgets
3.8.9.3.8.9 or later.SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve credential-named widget files by bypassing the sensitive-path guard in getFile. Attackers can request paths like /data/widgets/<package>/credentials.json for publish-referenced widgets to obtain API keys, tokens, or other stored secrets.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.