GHSA-4wwp-f6gw-6qm5: Go/github.com/siyuan-note/siyuan/kernel vulnerability
Summary: IsForbiddenAbsPath() only blocks conf/conf.json by exact match. The TLS private key (conf/key.pem) and CA private key (conf/ca.key) live in the same conf/ directory and are absent from the blocklist. Any authenticated user can retrieve them via POST /api/file/getFile.
Root cause kernel/util/pathguard.go, IsForbiddenAbsPath() has no entry for TLS key material. The getFile handler at kernel/api/file.go:497 skips the blocklist for RoleAdministrator, and in v3.8.1 all authenticated users receive RoleAdministrator (no non-admin role is currently issued to direct API consumers). The files are generated on every boot regardless of whether TLS is active.
Steps to reproduce: No token required on a default no-auth-code instance curl -s -X POST http://TARGET:6806/api/file/getFile \ -H "Content-Type: application/json" \ -d '{"path": "/conf/key.pem"}' curl -s -X POST http://TARGET:6806/api/file/getFile \ -H "Content-Type: application/json" \ -d '{"path": "/conf/ca.key"}'
Response: Raw PEM private key bytes.
<img width="927" height="467" alt="2026-08-1914-19" src="https://github.com/user-attachments/assets/12e0787f-6bfc-416a-b5ad-a22954e45c48" />
Impact: On deployments with TLS enabled (--ssl flag or NetworkServeTLS), possession of key.pem allows decryption of captured HTTPS traffic. Possession of ca.key allows signing certificates trusted by any client that imported SiYuan's locaprompts users to do). The files exist on every installation even whenTLS is currently inactive.
Prior art: This is the same class of bug as GHSA-9jfx-rc58-h23j (conf.json readable via template render) and GHSA-c8r8-95hg-mp34 (MCP file tool blocklist incomplete). The fix is to add conf/key.pem, conf/ca.key, conf/cert.pem, and conf/ca.crt to IsForbiddenAbsPath().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/siyuan-note/siyuan/kernelto a version that resolves this vulnerability.Fixed in 0.0.0-20260819144130-256d73aa7f94 - Configuration
Add conf/key.pem, conf/ca.key, conf/cert.pem, and conf/ca.crt to IsForbiddenAbsPath() so /api/file/getFile blocks access to TLS and CA key material.
SiYuan file access handler IsForbiddenAbsPath() blocklist = conf/key.pem, conf/ca.key, conf/cert.pem, conf/ca.crt
Event History
Frequently Asked Questions
Who can retrieve the TLS private keys?
Any authenticated user can retrieve the key files through POST /api/file/getFile. In v3.8.1, direct API consumers are assigned RoleAdministrator, and the handler skips the blocklist for that role.
Are default no-auth-code deployments exposed without credentials?
Yes. The provided reproduction states that no token is required on a default no-auth-code instance, allowing requests for /conf/key.pem or /conf/ca.key.
Is TLS required for the private keys to be exposed?
No. The TLS private key and CA private key files are generated on every boot even when TLS is not active.
How can I check whether an instance is affected?
On an instance where testing is authorized, send a POST request to /api/file/getFile with path set to /conf/key.pem or /conf/ca.key. Receiving raw PEM private-key data confirms exposure.