CVE-2026-85175 siyuan-note CVE debrief

Who should care

SiYuan users and administrators, particularly those with TLS enabled, should assess exposure and prioritize remediation due to the potential for decryption of captured HTTPS traffic and forging of certificates trusted by clients.

Why it matters

CVE-2026-85175 allows unauthorized access to sensitive keys in SiYuan versions <= 3.8.1, enabling decryption of HTTPS traffic and certificate forgery. SiYuan users and administrators should verify instance versions, restrict access, and update to version 3.8.2 or later.

• Decryption of captured HTTPS traffic using the disclosed TLS private key
• Forging of certificates trusted by clients that imported SiYuan's CA
• Potential unauthorized access to sensitive information
• Verification of instance version and remediation of vulnerable versions

Technical summary

The SiYuan application, versions <= 3.8.1, contains an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan's CA (ca.key). The vulnerability has been fixed in version 3.8.2. Users and administrators should assess exposure and prioritize remediation due to the potential for decryption of captured HTTPS traffic and forging of certificates trusted by clients. Affected deployments should verify instance versions and update to version 3.8.2 or later to mitigate the vulnerability. Additionally, reviewing and restricting access to sensitive files and directories, as well as monitoring for suspicious activity and unauthorized access attempts, are recommended defensive measures. The CVE record and source references indicate that SiYuan versions <= 3.8.1 contain an incomplete blocklist in the IsForbiddenAbsPath() function, allowing unauthorized access to TLS private keys and CA private keys. This vulnerability has a CVSS score of 8.7 and is considered HIGH severity. The CVE record was published on 2026-09-03T13:06:25.270Z and has not been modified since then. The official CVE Program record and NIST NVD detail page provide additional information on this vulnerability. SiYuan users and administrators should verify instance versions, restrict access, and update to version 3.8.2 or later to mitigate this vulnerability. The vulnerability allows unauthorized access to sensitive keys in SiYuan versions <= 3.8.1, enabling decryption of HTTPS traffic and certificate forgery. SiYuan users and administrators should verify instance versions, restrict access, and update to

Defensive priority

High priority for SiYuan users and administrators to verify and remediate vulnerable instances.

Recommended defensive actions

• Verify SiYuan instance version and check for vulnerable versions <= 3.8.1
• Update SiYuan to version 3.8.2 or later
• Review and restrict access to sensitive files and directories
• Monitor for suspicious activity and unauthorized access attempts
• Confirm whether affected SiYuan deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed SiYuan systems while remediation is scheduled and verified
• Track exceptions, retest remediated SiYuan assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source references indicate that SiYuan versions <= 3.8.1 contain an incomplete blocklist in the IsForbiddenAbsPath() function, allowing unauthorized access to TLS private keys and CA private keys.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.