Executive brief
SiYuan is a note-taking and knowledge management application. A reader-role user can exploit symlinks in the file-read endpoint to access files outside the workspace, bypassing security boundaries. This allows attackers with basic access to read sensitive files stored outside the intended workspace area.
Technical details
The vulnerability is a symlink-following path traversal (CWE-59) in SiYuan's reader-accessible file-read API endpoint. The handler performs lexical path validation to ensure requests stay within the workspace and applies reader-level authorization checks, but then follows filesystem symlinks when opening the actual file. An attacker with reader role can craft a request to a symlink located under data/assets/ that points to a file outside the workspace, bypassing the logical authorization checks. The fix (v3.8.2+) requires resolving symlinks before applying authorization and sensitive-path filters to the resolved target path.
Affected products
- SiYuan SiYuan before v3.8.2
Timeline
- 2026-08-21: disclosed: GitHub Security Advisory GHSA-g7gf-v79m-jwrm published
- 2026-09-04: advisory: CVE-2026-85583 published on NVD