GHSA-6gmc-424x-xgpm: SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix

Published Oct 25, 2026

Updated

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the prefix to localPath in /api/import/importStdMd to copy workspace conf files, including the API token and TLS private keys, into assets served to unauthenticated clients.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SiYuan to a version that resolves this vulnerability.
Fixed in 3.8.7

Event History

Oct 25, 2026

CVE Published

via OSV·01:20 PM

Data Sourced

via OSV·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

SiYuan versions from 3.5.4 before 3.8.7 are affected when running on Windows. The bypass concerns the Windows extended-length path prefix (\\?\).

What access does an attacker need to exploit it?

An attacker needs authenticated access to the API and must be able to call /api/import/importStdMd with a crafted localPath. No user interaction is required.

What data could be exposed?

The attacker can copy workspace configuration files into assets that are served to unauthenticated clients. The exposed files can include the API token and TLS private keys.

How can I tell whether exploitation may have occurred?

Review calls to /api/import/importStdMd for localPath values beginning with the Windows extended-length prefix (\\?\). Also inspect publicly served assets for copied workspace configuration files or other unexpected sensitive files.

GHSA-6gmc-424x-xgpm: SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need to exploit it?

What data could be exposed?

How can I tell whether exploitation may have occurred?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need to exploit it?

What data could be exposed?

How can I tell whether exploitation may have occurred?