Technical impact
SiYuan 3.5.4 through 3.8.6 on Windows has a path traversal flaw (CWE-22). The denial list of sensitive paths in the IsSensitivePath check can be bypassed when the Windows extended‑length prefix (\\?\) is applied, because it survives fpClean and does not match any forbidden prefix. As a result, an attacker who has API authentication can supply a localPath in the /api/import/importStdMd endpoint that starts with the prefix, causing the server to copy local configuration files—including the API token and TLS private key—into the public assets folder served to unauthenticated clients. This allows those unauthenticated clients to retrieve secrets that were intended to remain private and could lead to further compromise of the environment.
Affected Systems
This vulnerability affects SiYuan note versions 3.5.4 to 3.8.6 running on Windows. The product is identified by the vendor "siyuan-note" and product "siyuan". Users of earlier releases are not affected, and versions 3.8.7 and later are not vulnerable.
Risk and Exploitability
The CVSS score of 5.9 indicates medium impact and low to moderate exploitation risk. EPSS shows a very low exploitation probability (<1%) and the vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated API caller to provide a crafted path in the /api/import/importStdMd endpoint that starts with the Windows extended‑length prefix, causing the server to copy local configuration files—including the API token and TLS private key—into the public assets folder that is served to unauthenticated clients. This allows those unauthenticated clients to retrieve secrets that were intended to remain private and could lead to further compromise of the environment.
