CyberRota Analysis
AI-GeneratedSiYuan versions up to 3.8.1 are vulnerable due to an incomplete blocklist in the IsForbiddenAbsPath() function, allowing unauthorized access to sensitive TLS private keys and CA private keys stored in the configuration directory. This flaw enables any authenticated user, or any client on a default no-auth-code instance, to retrieve these keys, potentially leading to the decryption of HTTPS traffic and the forging of trusted certificates. Organizations using SiYuan, especially those with TLS enabled, should prioritize upgrading to version 3.8.2 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan's CA (ca.key).