CVE-2026-85175

HighCVSS 8.8/10Last modified Sep 8, 2026

Description

SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan's CA (ca.key).

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-552

Affected software

No affected versions have been published.

Timeline

Published: Sep 3, 2026
Last modified: Sep 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-851768.8DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file CVE-2026-851775.4CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated u CVE-2026-851787.7Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the reque CVE-2026-851798.5Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including CVE-2026-85188.8Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a CVE-2026-851807.5Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloa CVE-2026-851819.8CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid CVE-2026-851827.5vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated a CVE-2026-851839.3Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed CVE-2026-851849.1@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, CVE-2026-851859.6Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux all CVE-2026-851866.3A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdatei