CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated administrators in SiYuan versions prior to 3.8.1 to access sensitive historical snapshots and files, including plaintext passwords, through the improperly secured /history/* and /repo/diff/* endpoints. This could lead to unauthorized exposure of sensitive information, posing a risk to data confidentiality. Organizations using affected versions should prioritize patching to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can retrieve historical snapshots of sensitive files that the guard is meant to block, including data/.siyuan/publishAccess.json (plaintext publish-mode passwords) and files under data/templates/.