CVE-2026-85175

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.2

Description An incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path guard.go) fails to restrict access to the TLS private key (conf/key.pem) and the CA private key (conf/ca.key) within the conf/ directory. Since the getFile handler bypasses the blocklist for users with RoleAdministrator privileges, and all authenticated users are granted this role, any user or client on a default instance without an authentication code can retrieve these private keys via the 'POST /api/file/getFile' endpoint. In deployments with TLS enabled, this allows for the decryption of captured HTTPS traffic and the forging of certificates trusted by clients that imported the software's CA.

Recommendations Update to version 3.8.2. Restrict access to the 'POST /api/file/getFile' endpoint to minimize the risk of private key retrieval.