CVE-2026-85174: SiYuan before v3.8.2 API Token Exposure via Log File
SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be authenticated to SiYuan and able to make full-text search requests. They can trigger requests that exceed timing thresholds, then use the getFile endpoint to read the accessible log file.
What is the impact after exploitation?
The attacker can recover administrator API tokens written in plaintext to logs. Those tokens can provide permanent administrative access, with high impact to confidentiality, integrity, and availability.
Which versions need remediation?
SiYuan versions before 3.8.2 are affected. Upgrade to version 3.8.2 or later.
How can I determine whether tokens may already have been exposed?
Review accessible SiYuan log files for API tokens recorded in full-text search query parameters, particularly for searches that exceeded timing thresholds. Any administrator API token found in those logs should be treated as exposed.
What should be done if exposure is suspected?
Treat recovered administrator API tokens as compromised and rotate or invalidate them to remove persistent administrative access. Restrict authenticated access and access to the getFile endpoint until the affected version is remediated.