CVE-2026-118680: SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias
SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke importStdMd with a GLOBALROOT-prefixed path to copy the API token and TLS private key into the publicly served assets directory.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
SiYuan versions 3.8.7 through 3.8.8 are affected where the application runs on Windows and an attacker has the privileges needed to invoke the importStdMd function.
What does an attacker need to exploit it?
The attacker must be able to call importStdMd and supply a path using a Windows GLOBALROOT device-namespace prefix. Exploitation is rated high complexity and requires high privileges, but does not require user interaction.
What can an attacker obtain?
The vulnerable path handling can bypass the IsSensitivePath denylist and copy the API token and TLS private key into a publicly served assets directory. The reported impact is confidentiality loss, with no integrity or availability impact listed.