{"id":"EUVD-2026-70410","enisaUuid":"b33b4240-14b9-3571-9e66-9c2271186f39","description":"SiYuan versions \u003c\u003d 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan\u0027s CA (ca.key).","datePublished":"Sep 3, 2026, 11:22:22 AM","dateUpdated":"Sep 3, 2026, 12:12:14 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4wwp-f6gw-6qm5\nhttps://www.vulncheck.com/advisories/siyuan-before-3.8.2-tls-private-key-disclosure-via-getfile\n","aliases":"CVE-2026-85175\nGHSA-gg9w-4vv2-vjcm\n","assigner":"VulnCheck","epss":0.33,"enisaIdProduct":[{"id":"01b2f11a-e6f9-3dee-a1e6-5065509f846b","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"0 \u003c3.8.2"}],"enisaIdVendor":[{"id":"3c277ead-196b-3c34-bd00-6efe0d3b7bc0","vendor":{"name":"siyuan-note"}}],"enisaIdVulnerability":[{"id":"26a3f9f5-f0a2-33fb-b6d1-d634fcefc837","vulnerability":{"id":"CVE-2026-85175","description":"SiYuan versions \u003c\u003d 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan\u0027s CA (ca.key).","datePublished":"Sep 3, 2026, 11:22:22 AM","dateUpdated":"Sep 3, 2026, 12:12:14 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4wwp-f6gw-6qm5\nhttps://www.vulncheck.com/advisories/siyuan-before-3.8.2-tls-private-key-disclosure-via-getfile\n","enisa_id":"EUVD-2026-70410\n","assigner":"VulnCheck","epss":0.33,"dataProcessed":"Nov 1, 2026, 7:14:47 AM","vulnerabilityProduct":[{"id":"b4d47871-4631-3d4f-a54c-7b4e3bb03d2f","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"0 \u003c3.8.2"}],"vulnerabilityVendor":[{"id":"bb2f47c4-4b42-38fa-879d-0a7a43157dba","vendor":{"name":"siyuan-note"}}]}},{"id":"4c76e20a-a8a0-3bbb-b92c-8761776fbf45","vulnerability":{"id":"GHSA-gg9w-4vv2-vjcm","description":"SiYuan versions \u003c\u003d 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan\u0027s CA (ca.key).","datePublished":"Sep 3, 2026, 3:32:21 PM","dateUpdated":"Sep 3, 2026, 3:32:21 PM","baseScore":0.0,"references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4wwp-f6gw-6qm5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-85175\nhttps://www.vulncheck.com/advisories/siyuan-before-3.8.2-tls-private-key-disclosure-via-getfile\n","enisa_id":"EUVD-2026-70410\n","aliases":"CVE-2026-85175\nGHSA-gg9w-4vv2-vjcm\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}