CVE-2026-85175: SiYuan before v3.8.2 TLS Private Key Disclosure via getFile
SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/pathguard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan's CA (ca.key).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.8.2 - Configuration
Update the IsForbiddenAbsPath() function so the getFile handler correctly treats the TLS private key (conf/key.pem) and CA private key (conf/ca.key) as forbidden paths, not just conf/conf.json by exact match.
SiYuan (kernel/util/path_guard.go) getFile blocklist IsForbiddenAbsPath() forbidden paths = Block conf/key.pem and conf/ca.key (in addition to conf/conf.json exact match)
Event History
Frequently Asked Questions
Which deployments are exposed without requiring an attacker to obtain credentials?
Instances using the default no-auth-code configuration can be accessed by any client. In v3.8.1, authenticated users also receive RoleAdministrator, allowing them to bypass the path blocklist.
What must be enabled for the disclosed files to create TLS-specific impact?
TLS must be enabled for disclosure of conf/key.pem to permit decryption of captured HTTPS traffic. Disclosure of conf/ca.key enables certificate forgery only for clients that imported SiYuan's CA.
How can an administrator determine whether the instance is affected?
SiYuan versions 3.8.1 and earlier are affected; version 3.8.2 fixes the issue. The vulnerable file retrieval route is POST /api/file/getFile, and the exposed key paths are conf/key.pem and conf/ca.key.