CVE-2026-85174

SiYuan before v3.8.2 writes API tokens passed in query parameters into a plaintext, accessible log file whenever full-text search requests exceed timing thresholds (CWE-532, sensitive information exposure in logs). Because the condition is triggered by slow search traffic, tokens used by administrators can end up in the log during normal operation. An authenticated attacker can then call the getFile endpoint to read that log file, recover the admin's API token, and use it to gain permanent administrative access to the instance. All SiYuan deployments running versions prior to 3.8.2 are affected. There is currently no known exploitation, no public proof-of-concept, and a low predicted exploitation probability (EPSS 0.3%).

What to do: Upgrade SiYuan to v3.8.2 or later. As interim mitigation, restrict access to the server's log files and limit which authenticated roles can invoke the getFile endpoint, and rotate any API tokens (especially admin tokens) that may have been used in slow full-text search requests. Check exposed instances for tokens appearing in plaintext logs to determine whether credentials were already leaked.