CVE-2026-82651

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.1

Description An issue exists in kernel/server/serve.go where the IsForbiddenAbsPath guard is not applied to the '/history/*path' and '/repo/diff/*path' endpoints. Although these endpoints require administrator authentication, they construct file paths independently. This allows an authenticated administrator to retrieve historical snapshots of sensitive files, such as data/.siyuan/publishAccess.json, which contains plaintext publish-mode passwords, and files located under data/templates/.

Recommendations Update SiYuan to version 3.8.1 or later.