Live › vulnerability › GHSA-4wwp-f6gw-6qm5
Go to dashboardSiYuan's getFile endpoint can read TLS private key files because its path blocklist is incomplete. An attacker who can reach the API can obtain the server's TLS private key.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/siyuan-note/siyuan/kernel | go | < 0.0.0-20260819144130-256d73aa7f94 | 0.0.0-20260819144130-256d73aa7f94 |
Unknown from the sources.
Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260819144130-256d73aa7f94 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist) in github.com/siyuan-note/siyuan/kernel
This page as .md · .json · in your agent: get_signal("GHSA-4wwp-f6gw-6qm5")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.