{"id":"GHSA-4wwp-f6gw-6qm5","kind":"vulnerability","aliases":["GHSA-4wwp-f6gw-6qm5","GO-2026-6663"],"related":[],"title":"SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist) in github.com/siyuan-note/siyuan/kernel","description":"SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist) in github.com/siyuan-note/siyuan/kernel","summary":"SiYuan's getFile endpoint can read TLS private key files because its path blocklist is incomplete. An attacker who can reach the API can obtain the server's TLS private key.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/siyuan-note/siyuan/kernel","fixed":["0.0.0-20260819144130-256d73aa7f94"],"affected":"< 0.0.0-20260819144130-256d73aa7f94","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","siyuan"],"not_affected_if":["default-config"],"how_to_check":null,"fix":"Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260819144130-256d73aa7f94 or later.","status":"open","published_at":"2026-10-07T14:10:39+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:20:11+00:00","updated_at":"2026-10-23T20:20:11+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-23T20:20:11Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260819144130-256d73aa7f94 or later.","summary":"SiYuan's getFile endpoint can read TLS private key files because its path blocklist is incomplete. An attacker who can reach the API can obtain the server's TLS private key.","category":"package","who_cares":["go","siyuan","self-hosted"],"confidence":0.5,"analyst_note":"Sources give only the affected and fixed pseudo-versions; confirm the exact exposed endpoint and auth requirement at https://pkg.go.dev/vuln/GO-2026-6663.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"severity_if_unknown":"unknown"},"cost_usd":0.000346,"input_tokens":2072,"output_tokens":277,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':20A '-6663':21A '/siyuan-note/siyuan/kernel':13A,29A,79C '4wwp':16A,24A '6qm5':18A,26A 'api':58B 'attack':53B 'blocklist':9A,49B,75C 'endpoint':39B 'f6gw':17A,25A 'file':45B 'getfil':7A,38B,73C 'ghsa':15A,23A 'ghsa-4wwp-f6gw-6qm5':14A,22A 'github.com':12A,28A,78C 'github.com/siyuan-note/siyuan/kernel':11A,27A,77C 'go':19A,30B 'host':34B 'incomplet':8A,51B,74C 'key':4A,44B,66B,70C 'obtain':60B 'packag':31B 'path':48B 'privat':3A,43B,65B,69C 'reach':56B 'read':41B 'readabl':5A,71C 'self':33B 'self-host':32B 'server':62B 'siyuan':1A,35B,36B,67C 'tls':2A,42B,64B,68C 'via':6A,72C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-07T14:10:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6663","url":"https://pkg.go.dev/vuln/GO-2026-6663","severity":null,"published_at":"2026-10-07T14:10:39+00:00","modified_at":"2026-10-07T14:10:39+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}