Is CVE-2026-118680 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118680 being exploited in the wild.

How severe is CVE-2026-118680?

Medium severity, with a CVSS score of 4.4, published 28 October 2026.

Is there a fix for CVE-2026-118680?

Yes: fixed in SiYuan 3.8.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118680 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118680?

Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118680: SiYuan path traversal via GLOBALROOT alias bypass

CVE-2026-118680 · Severity: medium · CVSS 4.4 · Published 2026-10-28

SiYuan is a personal knowledge management system that stores notes and configuration files on Windows. A flaw in path validation allows attackers to bypass security checks using Windows GLOBALROOT device aliases, enabling them to copy sensitive files—including the API token and TLS private key—into a publicly accessible directory where they can be downloaded.

Technologies: SiYuan. Vendors: SiYuan.

Quick answers

Is CVE-2026-118680 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118680 being exploited in the wild.
How severe is CVE-2026-118680?: Medium severity, with a CVSS score of 4.4, published 28 October 2026.
Which products and versions are affected?: SiYuan 3.8.7 through 3.8.8.
Is there a fix for CVE-2026-118680?: Yes: fixed in SiYuan 3.8.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118680 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118680?: Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: SiYuan 3.8.9 or later

Technical details

A path normalization function in the kernel fails to strip the \\?\GLOBALROOT device-namespace prefix form before evaluating the IsSensitivePath denylist, allowing CWE-22 path traversal. An unauthenticated attacker can invoke the importStdMd API endpoint with a GLOBALROOT-prefixed path to read workspace configuration (conf.json with API token) and private key files, then copy them into the public assets directory. The incomplete fix from v3.8.7 only normalizes literal \\?\ and \\. prefixes, leaving the device-namespace alias unhandled.

Affected products

SiYuan SiYuan 3.8.7 through 3.8.8

Timeline

2026-10-13: disclosed: GitHub Security Advisory GHSA-gg3p-r4g8-vxg2 published
2026-10-28: advisory: CVE-2026-118680 and NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.