API Token Exposure in SiYuan Logging Mechanism

CVE-2026-85174

What is CVE-2026-85174?

Prior to version 3.8.2, SiYuan Note exposes sensitive API tokens through insufficient logging practices. When full-text search requests exceed specific timing thresholds, the system logs these tokens in plaintext to an accessible log file. This design flaw allows authenticated attackers to exploit the getFile endpoint to retrieve the log file, potentially leading to the recovery of administrative API tokens. If successfully exploited, this can grant attackers permanent administrative access to the application, highlighting the importance of secure logging practices.

References