Uncontrolled Search Path Vulnerability in SiYuan Windows Installer by SiYuan

CVE-2026-82649

What is CVE-2026-82649?

The SiYuan Windows installer prior to version 3.8.1 has a significant vulnerability allowing for local privilege escalation through an uncontrolled search path element. This issue occurs within the NSIS installer, which executes system commands like TASKKILL by name rather than utilizing an absolute path. An attacker can exploit this by dropping a malicious executable into the installer’s launch directory, which takes precedence over the System32 directory during command execution. As a result, if the installer is run with elevated privileges, the malicious binary can execute with these rights, leading to serious security risks. Timely updates and patches are essential to mitigate this vulnerability.

References