GO-2026-6662

vendorUSosv

SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/* in github.com/siyuan-note/siyuan/kernel

view advisory published 2026-10-07Licence: per source

SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/* in github.com/siyuan-note/siyuan/kernel

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-82651US	medium4.9OT elevated	0.48% (41st)	—	2026-08-30
SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go.…

references

External citations — patches, advisories, analysis.

https://github.com/siyuan-note/siyuan/commit/035bf9a8c311c6f8468f2f1054b4d5e1711787e2WEB
https://github.com/siyuan-note/siyuan/releases/tag/v3.8.1WEB
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3cm4-ccvw-6xr6ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan