The vulnerability in SiYuan (CVE-2026-59854) involves a protection mechanism failure (CWE-693) in the POST /api/file/globalCopyFiles endpoint prior to version 3.7.1. The endpoint accepts attacker-supplied absolute source paths and relies on a denylist implemented in util.IsSensitivePath to block sensitive files. However, this denylist omits several common home-directory credential files, enabling an authenticated administrator or API-token user to copy these files into the workspace and exfiltrate them through the file API. The vulnerability is addressed in versions 3.7.1-alpha.2 and 3.7.1.

An authenticated administrator or API-token user can bypass the intended protection mechanism to copy sensitive credential files from the home directory into the workspace. This can lead to exposure of sensitive credentials such as Git, database, Kubernetes, Docker, and GnuPG credentials. The confidentiality of these files is compromised, but there is no direct impact on integrity or availability. The CVSS 3.1 base score is 4.9 (medium severity) with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

A fix is available in SiYuan versions 3.7.1-alpha.2 and 3.7.1. Users should upgrade to one of these versions or later to remediate this vulnerability. No other mitigation guidance is provided or required as the issue is resolved by the official fix.