CVE-2026-116171

The software SiYuan versions 3.5.4 before 3.8.7 on Windows is vulnerable to a sensitive-path denylist bypass in the IsSensitivePath function. The root cause is that the Windows extended-length prefix (\?/) survives the filepath.Clean operation and fails to match forbidden prefixes. This allows au...