Executive brief
SiYuan is a note-taking and knowledge management application that supports encrypted HTTPS connections. Versions up to 3.8.1 have an incomplete security filter that fails to block access to TLS private keys stored on the server. An authenticated user (or any user on instances without authentication) can download these keys via the file retrieval API, enabling them to decrypt captured network traffic or forge trusted certificates.
Technical details
The vulnerability is an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go) that only blocks conf/conf.json by exact match but fails to restrict conf/key.pem (TLS private key), conf/ca.key (CA private key), conf/cert.pem, and conf/ca.crt. The getFile handler (kernel/api/file.go:497) bypasses the blocklist for users with RoleAdministrator, and in v3.8.1 all authenticated API users are assigned this role. On default no-auth-code instances, this permits unauthenticated access. An attacker can retrieve these keys via POST /api/file/getFile, enabling decryption of HTTPS traffic (key.pem) or certificate forgery (ca.key). The fix is available in v3.8.2, which adds the missing files to the blocklist.
Affected products
- SiYuan SiYuan versions <= 3.8.1 (fixed in 3.8.2)
Timeline
- 2026-09-03: disclosed
- 2026: patched: v3.8.2