SiYuan versions 3.8.7 through 3.8.8 have a vulnerability where Windows GLOBALROOT device-namespace aliases are not normalized, allowing attackers to bypass the IsSensitivePath denylist. This flaw enables attackers with appropriate privileges to invoke importStdMd with a specially crafted GLOBALROOT-prefixed path, resulting in unauthorized copying of sensitive files such as the API token and TLS private key into a publicly accessible directory.