CVE-2026-116171: SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix

Q: Which deployments are exposed?

The issue affects SiYuan versions from 3.5.4 before 3.8.7 running on Windows. The bypass relies on the Windows extended-length path prefix (\\?\).

Q: What does an attacker need to exploit this?

An attacker needs to be an authenticated API caller and able to submit a localPath value to /api/import/importStdMd. They can prepend the Windows extended-length prefix to bypass the sensitive-path denylist.

Q: What data could be exposed?

The attacker can copy workspace configuration files into assets that are served to unauthenticated clients. The described sensitive files include the API token and TLS private keys.

Q: How can defenders check for exploitation?

Review requests to /api/import/importStdMd for localPath values beginning with the Windows extended-length prefix (\\?\). Also inspect publicly served assets for copied workspace configuration files or other unexpected sensitive content.

Published Oct 25, 2026

Updated

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the prefix to localPath in /api/import/importStdMd to copy workspace conf files, including the API token and TLS private keys, into assets served to unauthenticated clients.

Affected Software

1 affected component

SiYuan SiYuan>=3.5.4<3.8.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SiYuan to a version that resolves this vulnerability.
Fixed in 3.8.7

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

The issue affects SiYuan versions from 3.5.4 before 3.8.7 running on Windows. The bypass relies on the Windows extended-length path prefix (\\?\).

What does an attacker need to exploit this?

An attacker needs to be an authenticated API caller and able to submit a localPath value to /api/import/importStdMd. They can prepend the Windows extended-length prefix to bypass the sensitive-path denylist.

What data could be exposed?

The attacker can copy workspace configuration files into assets that are served to unauthenticated clients. The described sensitive files include the API token and TLS private keys.

How can defenders check for exploitation?

Review requests to /api/import/importStdMd for localPath values beginning with the Windows extended-length prefix (\\?\). Also inspect publicly served assets for copied workspace configuration files or other unexpected sensitive content.

CVE-2026-116171: SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

What data could be exposed?

How can defenders check for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

What data could be exposed?

How can defenders check for exploitation?