SiYuan versions prior to 3.8.1 lack the IsForbiddenAbsPath guard on the /history/*path and /repo/diff/*path endpoints, which are intended to be restricted to administrators. This oversight allows an authenticated administrator to construct arbitrary file paths and retrieve historical snapshots of files that the guard should prevent access to. Attackers can thus obtain sensitive information such as plaintext publish-mode passwords stored in data/.siyuan/publishAccess.json and template files under data/templates/, jeopardizing confidentiality and potentially enabling further credential-based attacks.

The vulnerability affects installations of Siyuan Note (siyuan-note:siyuan) on any version before 3.8.1. The impact applies to authenticated administrator accounts that can reach the /history and /repo/diff API paths and read local file system data as specified.

The CVSS score of 6.9 indicates a moderate severity vulnerability. No EPSS data is available, and the issue is not listed in CISA KEV. An attacker must first obtain administrative credentials to trigger the flaw; once authenticated, the exploit path is straightforward by sending requests to the vulnerable endpoints with crafted path parameters. Successful exploitation results in unauthorized reading of sensitive configuration and template files, exposing credentials and internal data structures.