PT-2026-83576
CVE-2026-82650
·
تاريخ النشر
2026-08-30
·
تاريخ التحديث
2026-08-30
الوصف من
CVSS 4.0
5.9
متوسطةالمقاييسAV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
SiYuan version 3.8.0
Description
An authenticated attacker can exploit a path traversal and sensitive file exposure issue through the
RenderTemplate() function. This is reachable via the 'POST /api/template/render' endpoint. While the system restricts paths to the workspace directory using util.IsAbsPathInWorkspace, it fails to apply a sensitive-path exclusion blocklist. This allows the unauthorized reading of sensitive workspace files, such as conf/conf.json, which stores the API token and cookie signing key.Recommendations
Update SiYuan to version 3.8.1.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾