GHSA-gg3p-r4g8-vxg2: SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias

Published Oct 28, 2026

Updated

SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke importStdMd with a GLOBALROOT-prefixed path to copy the API token and TLS private key into the publicly served assets directory.

Event History

Oct 28, 2026

CVE Published

via OSV·06:59 PM

Data Sourced

via OSV·06:59 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

The issue affects SiYuan versions 3.8.7 through 3.8.8 on Windows, where GLOBALROOT device-namespace aliases are not normalized before the sensitive-path denylist is applied.

What access does an attacker need to exploit this?

The attacker needs high privileges and the ability to invoke the importStdMd functionality. No user interaction is required, and exploitation can be performed over the network.

What can an attacker obtain through successful exploitation?

An attacker can use a GLOBALROOT-prefixed path to copy the API token and TLS private key into the publicly served assets directory. This can expose those sensitive files to retrieval from the served assets location.

GHSA-gg3p-r4g8-vxg2: SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias

Event History

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need to exploit this?

What can an attacker obtain through successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need to exploit this?

What can an attacker obtain through successful exploitation?