CVE-2026-85580

SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive...

CVE-2026-85580 SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch

SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive...

CVE-2026-85580

SiYuan versions before v3.8.2 contain a path guard bypass in the MCP file-access handler , caused by case-sensitive matching on Linux filesystems. An attacker with low privileges can read the protected publishAccess.json file by requesting a case-variant path (e.g., PublishAccess.json), disclosin...

EUVD-2026-71003

SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive...

CVE-2026-85580 SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch

SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive...

EUVD-2026-70410

SiYuan versions = 3.8.1 fixed in v3.8.2 contain an incomplete blocklist in the IsForbiddenAbsPath function kernel/util/pathguard.go, which only blocks conf/conf.json by exact match and does not restrict the TLS private key conf/key.pem or CA private key conf/ca.key stored in the same conf/...

CVE-2026-82651

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard introduced in GHSA-c8r8-95hg-mp34 to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can...

CVE-2026-82651 SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard introduced in GHSA-c8r8-95hg-mp34 to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can...

GHSA-2956-977X-2W3R Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Summary image.download fetches a URL and writes the response to disk. It does not use the central path guard validatepathwithenvconfig, which confines writes to FLYTOSANDBOXDIR; instead it confines the output to outputdir, but outputdir is itself a caller parameter. Since the attacker sets both t...