CVE-2026-82650: Exposure of Resource to Wrong Sphere in siyuan-note siyuan
Description
SiYuan version 3.8.0 has a path traversal and sensitive file exposure vulnerability in its RenderTemplate function accessible via the POST /api/template/render endpoint. This flaw allows an authenticated attacker to read sensitive workspace files, including conf/conf.json, which contains critical secrets such as API tokens and cookie signing keys. The vulnerability arises because the endpoint restricts paths only to the workspace directory but does not exclude sensitive paths, unlike other file APIs. This issue is fixed in version 3.8.1.
CVSS v4.0
Score 5.9medium
Affected software
siyuan-note
siyuan
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
SiYuan 3.8.0 contains a path traversal and sensitive file exposure vulnerability in the RenderTemplate function (kernel/model/template.go), reachable through the POST /api/template/render endpoint (kernel/api/template.go). The endpoint restricts the supplied path to the workspace directory using util.IsAbsPathInWorkspace but does not apply sensitive-path exclusions like the file API's refuseToAccess() blocklist. Consequently, an authenticated attacker can read sensitive files within the workspace, including conf/conf.json, which holds the API token and cookie signing key. The vulnerability is addressed in version 3.8.1.
Potential Impact
An authenticated attacker can exploit this vulnerability to read sensitive files within the workspace directory, including configuration files containing API tokens and cookie signing keys. This exposure could lead to further compromise of the application or user sessions. The CVSS 4.0 score is 5.9 (medium severity), reflecting the need for authentication and the complexity of exploitation.
Mitigation Recommendations
Upgrade SiYuan to version 3.8.1 or later, where this vulnerability is fixed. No other mitigation is indicated by the vendor advisory. Patch status is confirmed by the fix in v3.8.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-30T13:38:00.101Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a944043acd9273b49a612b2
Added to database: 08/30/2026, 14:37:55 UTC
Last enriched: 09/07/2026, 15:36:41 UTC
Last updated: 10/13/2026, 18:48:24 UTC
Views: 88
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.