CVE-2026-82650: SiYuan before v3.8.1 Path Traversal via /api/template/render
SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function (kernel/model/template.go), reachable via the POST /api/template/render endpoint (kernel/api/template.go). The endpoint restricts the supplied path only to the workspace directory (util.IsAbsPathInWorkspace) but, unlike the file API's refuseToAccess() blocklist, applies no sensitive-path exclusion. This allows an authenticated attacker to read sensitive workspace files, including conf/conf.json, which contains the API token and cookie signing key. The issue is fixed in v3.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.1 - Operational
Rotate any API tokens and cookie signing keys that may be exposed because SiYuan < v3.8.1 could read sensitive files (e.g., conf/conf.json) via the POST /api/template/render path traversal vulnerability.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to send a POST request to /api/template/render. The vulnerable endpoint is network-accessible, but exploitation also requires high privileges according to the supplied vector.
What data can be exposed?
The endpoint can read sensitive files within the SiYuan workspace because it lacks the sensitive-path exclusions used by the file API. This includes conf/conf.json, which contains the API token and cookie signing key.
Are installations on version 3.8.0 affected, and what version fixes it?
SiYuan 3.8.0 is affected. The issue is fixed in SiYuan v3.8.1.
How can I determine whether an instance is vulnerable?
An instance is vulnerable if it runs a version before v3.8.1 and exposes the authenticated POST /api/template/render endpoint. The affected behavior is that RenderTemplate permits paths within the workspace without excluding sensitive files such as conf/conf.json.