GO-2026-6662 SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/* in github.com/siyuan-note/siyuan/kernel

SiYuan: /history/path and /repo/diff/path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/ in github.com/siyuan-note/siyuan/kernel...

SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*

Summary GHSA-c8r8-95hg-mp34 added a centralized guard, util.IsForbiddenAbsPath, specifically to block access to a small set of sensitive files: conf/conf.json plaintext accessAuthCode/API token/cookie key, data/snippets/conf.json, the entire data/templates/ directory, and...

GHSA-3CM4-CCVW-6XR6 SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*

Summary GHSA-c8r8-95hg-mp34 added a centralized guard, util.IsForbiddenAbsPath, specifically to block access to a small set of sensitive files: conf/conf.json plaintext accessAuthCode/API token/cookie key, data/snippets/conf.json, the entire data/templates/ directory, and...

CVE-2026-82651

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard introduced in GHSA-c8r8-95hg-mp34 to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can...

CVE-2026-82651: Exposure of Sensitive Information to an Unauthorized Actor

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard introduced in GHSA-c8r8-95hg-mp34 to the /history/path and /repo/diff/path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can...