Path Traversal Vulnerability in SiYuan Note 3.8.7 and 3.8.8

CVE-2026-118680

What is CVE-2026-118680?

SiYuan Note versions 3.8.7 through 3.8.8 have a path traversal vulnerability that occurs when the application fails to properly normalize Windows GLOBALROOT device-namespace aliases. This flaw allows attackers to bypass the IsSensitivePath denylist, enabling them to invoke importStdMd with a GLOBALROOT-prefixed path. As a result, malicious users can potentially copy sensitive information, such as API tokens and TLS private keys, into the publicly accessible assets directory, leading to unauthorized exposure. It is critical for users of affected versions to apply security patches to mitigate this risk.

References