CVE-2026-82650: SiYuan before v3.8.1 Path Traversal via /api/template/render

Published Aug 30, 2026
·
Updated

SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function (kernel/model/template.go), reachable via the POST /api/template/render endpoint (kernel/api/template.go). The endpoint restricts the supplied path only to the workspace directory (util.IsAbsPathInWorkspace) but, unlike the file API's refuseToAccess() blocklist, applies no sensitive-path exclusion. This allows an authenticated attacker to read sensitive workspace files, including conf/conf.json, which contains the API token and cookie signing key. The issue is fixed in v3.8.1.

Affected Software

1 affected component
SiYuan SiYuan<3.8.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade SiYuan to a version that resolves this vulnerability.

    Fixed in 3.8.1
  2. Operational

    Rotate any API tokens and cookie signing keys that may be exposed because SiYuan < v3.8.1 could read sensitive files (e.g., conf/conf.json) via the POST /api/template/render path traversal vulnerability.

Event History

Aug 30, 2026
CVE Published
via MITRE·02:33 PM
Data Sourced
via MITRE·02:33 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who can exploit this issue?

An attacker must be authenticated and able to send a POST request to /api/template/render. The vulnerable endpoint is network-accessible, but exploitation also requires high privileges according to the supplied vector.

2

What data can be exposed?

The endpoint can read sensitive files within the SiYuan workspace because it lacks the sensitive-path exclusions used by the file API. This includes conf/conf.json, which contains the API token and cookie signing key.

3

Are installations on version 3.8.0 affected, and what version fixes it?

SiYuan 3.8.0 is affected. The issue is fixed in SiYuan v3.8.1.

4

How can I determine whether an instance is vulnerable?

An instance is vulnerable if it runs a version before v3.8.1 and exposes the authenticated POST /api/template/render endpoint. The affected behavior is that RenderTemplate permits paths within the workspace without excluding sensitive files such as conf/conf.json.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203