CVE-2026-126264

SiYuan versions before 3.8.9 are vulnerable to an information disclosure vulnerability. Authenticated Reader users can bypass the sensitive-path guard in the /api/file/getFile endpoint to retrieve credential-named widget files. By requesting specific paths such as /data/widgets//credentials.json ...