CVE-2026-116171 SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix \?\ survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the prefix to localPath in /api/import/importStdMd to cop...

CVE-2026-116171

The software SiYuan versions 3.5.4 before 3.8.7 on Windows is vulnerable to a sensitive-path denylist bypass in the IsSensitivePath function. The root cause is that the Windows extended-length prefix (\?/) survives the filepath.Clean operation and fails to match forbidden prefixes. This allows au...

CVE-2026-32750: Improper Limitation of a Pathname to a Restricted Directory

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importStdMd passes the localPath parameter directly to model.ImportFromLocalPath with zero path validation. The function recursively reads every file under the given path and permanently stores their...