SiYuan versions before 3.8.2 have a denial of service vulnerability in the publish-service Basic Auth throttle mechanism. The flaw allows unauthenticated attackers to submit repeated authentication requests with unique invalid usernames, causing memory exhaustion and increased synchronization overhead. This degrades service availability by allocating resources without limits or eviction policies.
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace and receive the target file bytes, bypassing workspace boundary restrictions.
SiYuan versions before v3.8.2 contain an unbounded session creation vulnerability in the publish-service Basic Auth handler that allows authenticated attackers to exhaust memory. Attackers can repeatedly authenticate with valid credentials to create persistent session entries without expiry or capacity limits, causing indefinite process memory growth and denial of service.
SiYuan before v3.8.2 contains a denial of service vulnerability in the unauthenticated /api/system/uiproc endpoint that accepts and retains attacker-controlled process identifiers without size limits or authentication. Attackers can send repeated requests with unique identifiers to exhaust process memory and degrade service availability.
SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive publish-access configuration and metadata.
SiYuan note-taking software versions prior to 3.8.2 contain an information disclosure vulnerability in the POST /api/transactions/undoState endpoint. This flaw allows an authenticated reader with knowledge of a visible document's root ID to retrieve internal root IDs of other documents modified in the same transaction, including private or unpublished ones. The vulnerability does not expose document content directly but reveals internal identifiers and cross-document relationships. The issue was fixed in version 3.8.2.
SiYuan versions up to 3.8.1 have an authorization bypass vulnerability in the /api/file/getFile endpoint. This flaw allows users with reader roles to access files from notebooks that are explicitly set as not visible (Visible:false). By knowing the hidden notebook identifier and file path, attackers can retrieve private workspace files, including notebook metadata and internal configuration.
SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan's CA (ca.key).
SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access.
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.
SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block.
SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with HTML/script payloads in the name field that execute in users' browsers when uninstalling packages or unlocking encrypted notebooks.
SiYuan note-taking software versions before 3.8.1 have a vulnerability where invisible-tier content is not properly filtered in certain listing mechanisms during publish mode. This allows anonymous readers to enumerate content that was intended to be unlisted by the administrator. The issue affects SQL embed blocks, attribute-view keys, and attribute-view backlinks.
CVE-2026-82651 is a medium severity vulnerability in siyuan-note before version 3.8.1 where certain endpoints do not apply a security guard to restrict access to sensitive file paths. Authenticated administrators can access historical snapshots of sensitive files, including plaintext publish-mode passwords and template files, due to missing path validation on /history/*path and /repo/diff/*path endpoints.
SiYuan version 3.8.0 has a path traversal and sensitive file exposure vulnerability in its RenderTemplate function accessible via the POST /api/template/render endpoint. This flaw allows an authenticated attacker to read sensitive workspace files, including conf/conf.json, which contains critical secrets such as API tokens and cookie signing keys. The vulnerability arises because the endpoint restricts paths only to the workspace directory but does not exclude sensitive paths, unlike other file APIs. This issue is fixed in version 3.8.1.
SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an uncontrolled search path element vulnerability in its NSIS installer, which invokes system executables such as TASKKILL by name rather than by absolute path. Because NSIS nsExec::Exec resolves these calls using a search path that includes the installer's own launch directory ahead of System32, an attacker who plants a malicious executable (e.g., a renamed TASKKILL.exe) in that directory can have it executed when the installer runs. These calls occur in electron-builder's preInit hook before the license page is displayed, and with an all-users (elevated) install the planted binary executes with an elevated token, resulting in local privilege escalation.
SiYuan note-taking software versions before v3.8.1 have a server-side request forgery (SSRF) vulnerability in the http_request and web_fetch agent tools. The flaw arises because DNS resolution is only checked at guard time, not at connect time, allowing attackers to use DNS rebinding to bypass SSRF protections. This can enable access to cloud instance metadata and internal services.
SiYuan before version 3.8.1 has a path traversal vulnerability in its asset.upload MCP tool. This flaw allows attackers to specify arbitrary absolute file paths without validating workspace boundaries. Consequently, an attacker can trick the AI Agent into uploading sensitive files from outside the workspace, such as SSH keys or credentials, into the asset directory via prompt injection.
SiYuan note-taking software versions before 3.7.4 contain a vulnerability where the application does not properly verify that the packageName matches the downloaded package content during bazaar install operations. This flaw allows attackers with same-origin access to overwrite trusted plugins by manipulating packageName and repoURL parameters, potentially maintaining persistence across application restarts.
SiYuan versions prior to 3.7.4 have a path traversal vulnerability in the /api/search/removeTemplate endpoint. This flaw allows authenticated admin users to supply arbitrary filesystem paths to a deletion function, enabling recursive deletion of files or directories with the kernel process's permissions. The vulnerability is rated high severity with a CVSS 4.0 score of 8.4.