CVE-2026-85578: SiYuan through 3.8.1 Authorization Bypass via getFile
SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly configured as Visible:false. Attackers with reader role can access private workspace files including notebook metadata and internal configuration by knowing the hidden notebook identifier and file path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.1Patch Authorization Bypass via getFile - Compensating control
If immediate upgrade is not possible, restrict access to the SiYuan /api/file/getFile endpoint so that reader-role users cannot call it.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already have a SiYuan reader role. They also need to know the identifier of a notebook configured with Visible:false and the path of a target file within it.
What information could be exposed?
A reader can retrieve files from notebooks intended to be hidden, including private workspace files, notebook metadata, and internal configuration files.
Which deployments are affected?
SiYuan versions through 3.8.1 are affected where readers can reach the /api/file/getFile endpoint and hidden notebooks are configured with Visible:false.