CVE-2026-85174: Insertion of Sensitive Information into Log File in siyuan-note siyuan

CVE-2026-85174 affects SiYuan note-taking software versions prior to 3.8.2. The vulnerability arises because the application logs API tokens from query parameters in plaintext to a log file when full-text search requests exceed certain timing thresholds. This log file is accessible through the getFile endpoint to authenticated users. An attacker with authenticated access can read these logs, extract admin API tokens, and gain permanent administrative privileges. The vulnerability is rated high severity with a CVSS 4.0 score of 8.7, indicating network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the affected version range is not explicitly stated but is described as versions before 3.8.2.

An authenticated attacker can read sensitive API tokens logged in plaintext, enabling recovery of admin API tokens. This leads to permanent administrative access, compromising the confidentiality, integrity, and availability of the affected system. The vulnerability poses a significant risk due to the potential for privilege escalation and persistent control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the getFile endpoint to trusted users only and monitor for unauthorized access. Avoid using vulnerable versions if possible and follow vendor updates closely.