The vulnerability in Siyuan's /api/file/getFile endpoint allows attackers to read protected configuration files by using mixed-case paths on case-insensitive file systems. The flaw arises from case-sensitive string equality checks that are ineffective on such systems. If exploited, an attacker can obtain sensitive data stored in configuration files, potentially compromising the system's confidentiality and integrity.

The affected product is Siyuan, a personal knowledge management system developed by siyuan-note. Versions prior to 3.5.5 contain the flaw. All installations on Windows or other case-insensitive file systems are at risk.

With a CVSS score of 7.5, the vulnerability carries a high severity. The EPSS score is less than 1%, indicating a low current exploitation probability. It is not listed in the CISA KEV catalog. Attackers can exploit the API by sending requests with mixed-case filenames on a case-insensitive file system to bypass the intended restrictions. This requires the ability to send HTTP requests to the target application, potentially through network exposure or local component interaction.