CVE-2026-85583: SiYuan before v3.8.2 Path Traversal via symlink in file API
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace and receive the target file bytes, bypassing workspace boundary restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.8.2 - Compensating control
Ensure the reader-accessible file-read endpoint does not follow symlinks that point outside the workspace (enforce workspace boundary checks / disable symlink-following for assets under data/assets/).
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker needs a SiYuan account with the reader role. No user interaction is required.
What must be present for data outside the workspace to be exposed?
A logical asset under data/assets/ must be a symlink that points to a file outside the workspace. The reader-accessible file-read endpoint then follows that symlink and returns the target file's bytes.
How can I determine whether an instance is affected?
SiYuan versions before v3.8.2 are affected. Systems are exposed where reader-accessible authorized asset paths include symlinks to files outside the workspace.