CVE-2026-82651: Siyuan-Note Siyuan

Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days.

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can retrieve historical snapshots of sensitive files that the guard is meant to block, including data/.siyuan/publishAccess.json (plaintext publish-mode passwords) and files under data/templates/.

Affected products

• Siyuan-Note Siyuan: before 3.8.1 (fixed in 3.8.1)

Published 2026-08-30. Last modified 2026-08-31.