CVE-2026-126264
SiYuan before 3.8.9 Sensitive File Disclosure via /api/file/getFile
CVSS Score
7.7
EPSS Score
0.0%
EPSS Percentile
0th
SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve credential-named widget files by bypassing the sensitive-path guard in getFile. Attackers can request paths like /data/widgets/<package>/credentials.json for publish-referenced widgets to obtain API keys, tokens, or other stored secrets.
| CWE | CWE-200 |
| Vendor | siyuan-note |
| Product | siyuan |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for siyuan-note siyuan
Be the first to know when new high vulnerabilities affecting siyuan-note siyuan are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
siyuan-note / siyuan
0 < 3.8.9
References
github.com: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3pm7-cc76-7j2p github.com: https://github.com/siyuan-note/siyuan/commit/d122dee55e8d3c77de313d0ad6efae8b6b0ebc07 vulncheck.com: https://www.vulncheck.com/advisories/siyuan-before-3.8.9-sensitive-file-disclosure-via-api-file-getfile
Credits
🔍 rexpository