Vulnerability Description
SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan's CA (ca.key).
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4wwp-f6gw-6qm5
- https://www.vulncheck.com/advisories/siyuan-before-3.8.2-tls-private-key-disclos
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4wwp-f6gw-6qm5
FAQ
What is CVE-2026-85175?
CVE-2026-85175 is a vulnerability with a CVSS score of 8.8 (HIGH). SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does no...
How severe is CVE-2026-85175?
CVE-2026-85175 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-85175?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.