{"id":"EUVD-2026-68237","enisaUuid":"917cfeaf-c660-38b3-b8a1-b3bd2e8cb870","description":"SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can retrieve historical snapshots of sensitive files that the guard is meant to block, including data/.siyuan/publishAccess.json (plaintext publish-mode passwords) and files under data/templates/.","datePublished":"Aug 30, 2026, 2:33:33 PM","dateUpdated":"Aug 31, 2026, 6:52:24 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3cm4-ccvw-6xr6\nhttps://www.vulncheck.com/advisories/siyuan-before-3.8.1-missing-authorization-via-history-and-repo-diff\n","aliases":"CVE-2026-82651\nGHSA-j8f5-rf5j-w7pm\n","assigner":"VulnCheck","epss":0.48,"enisaIdProduct":[{"id":"f9302ab5-a036-303c-b7f7-194bb4790fa8","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"0 \u003c3.8.1"}],"enisaIdVendor":[{"id":"f2d06d26-ada6-334b-9313-2648ca282b73","vendor":{"name":"siyuan-note"}}],"enisaIdVulnerability":[{"id":"96de6d52-c8b6-30ea-ae1a-fb46a308cb20","vulnerability":{"id":"CVE-2026-82651","description":"SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can retrieve historical snapshots of sensitive files that the guard is meant to block, including data/.siyuan/publishAccess.json (plaintext publish-mode passwords) and files under data/templates/.","datePublished":"Aug 30, 2026, 2:33:33 PM","dateUpdated":"Aug 31, 2026, 6:52:24 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3cm4-ccvw-6xr6\nhttps://www.vulncheck.com/advisories/siyuan-before-3.8.1-missing-authorization-via-history-and-repo-diff\n","enisa_id":"EUVD-2026-68237\n","assigner":"VulnCheck","epss":0.48,"dataProcessed":"Nov 7, 2026, 7:24:19 AM","vulnerabilityProduct":[{"id":"5d9f7c86-120d-32ab-8e64-d666a2097ef4","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"0 \u003c3.8.1"}],"vulnerabilityVendor":[{"id":"7bb87be9-ad9d-3d87-927e-4c5cb6c376c9","vendor":{"name":"siyuan-note"}}]}},{"id":"d076a35a-c5bc-3f6e-a8fc-78fc90cf497a","vulnerability":{"id":"GHSA-j8f5-rf5j-w7pm","description":"SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can retrieve historical snapshots of sensitive files that the guard is meant to block, including data/.siyuan/publishAccess.json (plaintext publish-mode passwords) and files under data/templates/.","datePublished":"Aug 30, 2026, 3:30:28 PM","dateUpdated":"Aug 30, 2026, 3:30:28 PM","baseScore":0.0,"references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3cm4-ccvw-6xr6\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-82651\nhttps://www.vulncheck.com/advisories/siyuan-before-3.8.1-missing-authorization-via-history-and-repo-diff\n","enisa_id":"EUVD-2026-68237\n","aliases":"GHSA-j8f5-rf5j-w7pm\nCVE-2026-82651\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}