SiYuan 3.8.7 through 3.8.8 does not normalize Windows GLOBALROOT device-namespace aliases, allowing an attacker to bypass the IsSensitivePath denylist. By invoking the importStdMd API with a GLOBALROOT-prefixed path, the application copies the API token and TLS private key into the publicly served assets directory. This vulnerability exposes credentials and private keys, compromising confidentiality and potentially enabling further attacks such as impersonation or man‑in‑the‑middle.

The affected product is Siyuan Note, versions 3.8.7 and 3.8.8. The flaw is specific to Windows environments where GLOBALROOT aliases are available.

The CVSS score of 5.9 indicates a moderate risk. The EPSS score is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers who can reach the importStdMd API endpoint—potentially over the network or via local access—can exploit the bug to retrieve API tokens and TLS private keys, leading to credential compromise and possible system takeover.