Is CVE-2026-116171 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116171 being exploited in the wild.

How severe is CVE-2026-116171?

High severity, with a CVSS score of 7.5, published 25 October 2026.

Which products and versions are affected?

SiYuan Note SiYuan 3.5.4 through 3.8.6 on Windows.

Is there a fix for CVE-2026-116171?

Yes: fixed in 3.8.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116171 attacked?

It is attacked over the network.

Am I affected by CVE-2026-116171?

Check whether you run SiYuan Note SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116171: SiYuan path-traversal bypass via Windows extended-length prefix

CVE-2026-116171 · Severity: high · CVSS 7.5 · Published 2026-10-25

SiYuan is a note-taking application on Windows whose security checks fail to block access to sensitive files when they are prefixed with a Windows extended-length path. An authenticated user can exploit this to copy configuration files containing API tokens and TLS private keys into publicly accessible directories, exposing credentials to anyone with network access to the application.

Technologies: SiYuan Note SiYuan. Vendors: SiYuan Note.

Quick answers

Is CVE-2026-116171 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116171 being exploited in the wild.
How severe is CVE-2026-116171?: High severity, with a CVSS score of 7.5, published 25 October 2026.
Which products and versions are affected?: SiYuan Note SiYuan 3.5.4 through 3.8.6 on Windows.
Is there a fix for CVE-2026-116171?: Yes: fixed in 3.8.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116171 attacked?: It is attacked over the network.
Am I affected by CVE-2026-116171?: Check whether you run SiYuan Note SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.8.7

Technical details

The vulnerability is a denylist bypass in the IsSensitivePath function on Windows: the extended-length prefix \\?\ is preserved by filepath.Clean and does not match any forbidden prefix in the denylist, allowing attackers to access protected paths. Authenticated callers to /api/import/importStdMd or /api/export/copyExportFile can prepend \\?\ to the localPath parameter to copy workspace conf files (API tokens, TLS keys) into data/assets/ served without authentication.

Affected products

siyuan-note SiYuan 3.5.4 through 3.8.6 on Windows

Timeline

2026-10-09: disclosed
2026-10-25: advisory
2026: patched: v3.8.7 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.