CVE-2026-85175

SiYuan versions 3.8.1 and earlier contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go) that only blocks conf/conf.json by exact match, leaving the TLS private key (conf/key.pem) and CA private key (conf/ca.key) in the same conf/ directory readable. The vulnerability is triggered through the /api/file/getFile handler, which skips the blocklist for RoleAdministrator, and because all authenticated users are granted RoleAdministrator in v3.8.1, any user — or any client on a default no-auth-code instance — can retrieve these private keys via a POST to /api/file/getFile. On deployments with TLS enabled, an attacker with network access to the instance can use key.pem to decrypt captured HTTPS traffic and ca.key to forge certificates trusted by clients that imported SiYuan's CA. All SiYuan deployments running 3.8.1 or earlier are affected, with the greatest impact on network-reachable instances, particularly those without an access authorization code. No public proof-of-concept, KEV listing, or in-the-wild exploitation is known; EPSS estimates only a 0.2% probability of exploitation in the next 30 days.

What to do: Upgrade to SiYuan v3.8.2 or later, which restricts reads of conf/key.pem and conf/ca.key. Until upgraded, limit network exposure of the instance (bind to localhost or restrict via firewall) and set an access authorization code so that anonymous clients cannot call /api/file/getFile. If an instance was network-accessible with TLS enabled, treat key.pem and ca.key as potentially compromised and rotate the TLS key and CA key, re-issuing any certificates trusted by clients.