Inadequate Path Protection in SiYuan Allows Unauthorized Access to Private Keys

CVE-2026-85175

What is CVE-2026-85175?

Versions of SiYuan up to 3.8.1 are susceptible to a vulnerability that stems from an improper blocklist in the IsForbiddenAbsPath() function. This bug allows authenticated users and clients to bypass restrictions on accessing sensitive files, namely the TLS private key (conf/key.pem) and CA private key (conf/ca.key), due to limited blocking capabilities that only address conf/conf.json. Consequently, any user can exploit the /api/file/getFile endpoint to access these keys, which compromises the integrity of deployments with TLS enabled, permitting unauthorized decryption of HTTPS traffic and the opportunity to forge certificates trusted by clients that have imported SiYuan's CA.

References