CVE-2026-85175: Files or Directories Accessible to External Parties in siyuan-note siyuan

SiYuan versions <= 3.8.1 contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go) that only blocks access to conf/conf.json by exact match but does not restrict access to TLS private key files (conf/key.pem) or CA private key files (conf/ca.key) in the same directory. Since the getFile handler bypasses the blocklist for RoleAdministrator users and all authenticated users receive this role in v3.8.1, any authenticated user or client on a default no-auth-code instance can retrieve these private keys via the POST /api/file/getFile API. This exposure allows decryption of captured HTTPS traffic and forging of certificates trusted by clients that imported SiYuan's CA. The issue is resolved in version 3.8.2.

Exposure of TLS private keys (key.pem) and CA private keys (ca.key) allows attackers to decrypt HTTPS traffic and forge trusted certificates, compromising confidentiality and trust of communications on affected deployments. Any authenticated user or client on a default no-auth-code instance can exploit this vulnerability to obtain these keys.

A fix is available in SiYuan version 3.8.2. Users should upgrade to version 3.8.2 or later to remediate this vulnerability. Until upgrading, restrict access to the API endpoint POST /api/file/getFile and ensure proper authentication and authorization controls are in place to prevent unauthorized retrieval of private keys.