CVE-2026-82651 siyuan-note CVE debrief

Who should care

Administrators and users of SiYuan versions before v3.8.1, especially those with sensitive files stored in the application, should review and apply the vendor remediation to prevent potential unauthorized access to historical snapshots of sensitive files. This includes reviewing system configurations, access controls, and file permissions to ensure that sensitive information is properly protected. Additionally, security teams and vulnerability management teams should be aware of the potential risks and take steps to mitigate them.

Technical summary

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, allowing authenticated administrators to retrieve historical snapshots of sensitive files that the guard is meant to block, including data/.siyuan/publishAccess.json (plaintext publish-mode passwords) and files under data/templates/. The vulnerability allows for potential unauthorized access to sensitive information.

Defensive priority

Authenticated administrators may be able to retrieve historical snapshots of sensitive files due to missing authorization checks in SiYuan versions before v3.8.1.

Recommended defensive actions

• Review and apply vendor remediation for SiYuan versions before v3.8.1
• Inventory checks for SiYuan installations and sensitive file exposure
• Monitor for suspicious activity related to historical snapshots of sensitive files
• Implement compensating controls to restrict access to sensitive files
• Verify remediation application and monitor system logs
• Conduct regular security audits for sensitive file access
• Track remediation exceptions and retest affected assets

Evidence notes

The CVE record indicates that SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard to certain endpoints, allowing authenticated administrators to retrieve historical snapshots of sensitive files. Evidence is limited, and further verification is required to confirm the scope of affected systems and sensitive data. Additional review of system configurations, access controls, and file permissions is necessary to assess the potential impact. Defenders should verify that the remediation is applied and monitor for suspicious activity related to historical snapshots of sensitive files.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.