SiYuan versions 3.8.1 and earlier contain an incomplete blocklist in the IsForbiddenAbsPath function that does not protect the TLS private key (conf/key.pem) or CA private key (conf/ca.key). The getFile API bypasses this blocklist for all authenticated users who receive the RoleAdministrator role by default, and any client can reach the API on a default no‑auth instance. This allows an attacker to retrieve the private keys via a POST request to /api/file/getFile. With access to key.pem the attacker can decrypt captured HTTPS traffic, and with ca.key the attacker can forge certificates trusted by clients that have imported SiYuan's CA, potentially enabling man‑in‑the‑middle attacks and other certificate‑based threats.

SiYuan by siyuan‑note, versions 3.8.1 and older are affected. The vulnerability is fixed starting in version 3.8.2.

The CVSS score of 8.7 indicates a high‑severity flaw. The EPSS score is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is a network‑based API call; any authenticated user can exploit the flaw, and unauthenticated clients on deployment with the default no‑auth configuration can also retrieve the secret files. The exploitation requires no special conditions beyond the standard API access and yields the attacker the TLS private key, enabling a range of post‑exfiltration attacks such as decrypting traffic or forging client‑trusted certificates.