Security Advisory
CVE-2026-85583
6.5
MEDIUM
Vulnerability Description
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace and receive the target file bytes, bypassing workspace boundary restrictions.
Published Date
September 4, 2026
Official Source
NIST NVD Advisory