CVE-2026-126264: SiYuan before 3.8.9 Sensitive File Disclosure via /api/file/getFile
SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve credential-named widget files by bypassing the sensitive-path guard in getFile. Attackers can request paths like /data/widgets/<package>/credentials.json for publish-referenced widgets to obtain API keys, tokens, or other stored secrets.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the Reader role can exploit it. The attacker must be able to send requests to the SiYuan API; no additional user interaction is required.
Which files are exposed?
The issue affects credential-named files, such as credentials.json, under /data/widgets/<package>/ for widgets referenced by publish content. These files may contain API keys, tokens, or other stored secrets.
Are deployments running the default configuration affected?
The provided information does not identify a configuration change required for exploitation. Exposure depends on having publish-referenced widgets with credential-named files accessible through the affected getFile endpoint.
What version should be used to remediate the issue?
Upgrade SiYuan to version 3.8.9 or later. Versions before 3.8.9 are affected.