Ghostoverflow

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.8.2 **Description** Plaintext API tokens are written to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can utilize the 'getFile' endpoint to read this log file, allowing them to recover admin API tokens and obtain permanent administrative access. **Recommendations** Update to version 3.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** SiYuan versions prior to 3.8.2 **Description** An incomplete blocklist in the `IsForbiddenAbsPath()` function (kernel/util/path guard.go) fails to restrict access to the TLS private key (conf/key.pem) and the CA private key (conf/ca.key) within the conf/ directory. Since the `getFile` handler bypasses the blocklist for users with RoleAdministrator privileges, and all authenticated users are granted this role, any user or client on a default instance without an authentication code can retrieve these private keys via the 'POST /api/file/getFile' endpoint. In deployments with TLS enabled, this allows for the decryption of captured HTTPS traffic and the forging of certificates trusted by clients that imported the software's CA. **Recommendations** Update to version 3.8.2. Restrict access to the 'POST /api/file/getFile' endpoint to minimize the risk of private key retrieval.