CVE-2026-59854

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.1

Description An authenticated administrator or API-token user can exfiltrate sensitive files from the host system. The 'POST /api/file/globalCopyFiles' endpoint accepts absolute source paths and uses the util.IsSensitivePath function in kernel/util/path.go to validate them. However, the denylist used by this function fails to include common home-directory credential files, such as .git-credentials, .netrc, .pgpass, .kube/config, .docker/config.json, and .gnupg, allowing these files to be copied into the workspace and accessed via the file API.

Recommendations Update to version 3.7.1 or 3.7.1-alpha.2.