CVE-2026-116171

The software SiYuan versions 3.5.4 before 3.8.7 on Windows is vulnerable to a sensitive-path denylist bypass in the IsSensitivePath function. The root cause is that the Windows extended-length prefix (\?/) survives the filepath.Clean operation and fails to match forbidden prefixes. This allows au...

CVE-2026-116171 SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix \?\ survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the prefix to localPath in /api/import/importStdMd to cop...