CVE-2026-82651: SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff
SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can retrieve historical snapshots of sensitive files that the guard is meant to block, including data/.siyuan/publishAccess.json (plaintext publish-mode passwords) and files under data/templates/.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires authentication as a SiYuan administrator. An unauthenticated remote attacker is not described as able to access the affected endpoints.
What information could an administrator retrieve through the affected routes?
The affected /history/*path and /repo/diff/*path routes can expose historical snapshots of files that should be blocked by the absolute-path guard. Examples include data/.siyuan/publishAccess.json, which contains plaintext publish-mode passwords, and files under data/templates/.
Are default deployments affected?
The provided information identifies affected SiYuan versions before v3.8.1, but does not state whether the vulnerable paths or publish-mode passwords are present or enabled in a default deployment.
How can I determine whether my instance is affected?
Check the deployed SiYuan version. Versions before v3.8.1 are affected; the fix is the application of the IsForbiddenAbsPath guard to the /history/*path and /repo/diff/*path endpoints.