Siyuan Note: Critical XSS & High-Severity Flaws Disclosed Together in Batch
Siyuan Note users face critical XSS and high-severity path traversal/token disclosure risks from three vulnerabilities patched in v3.8.2.
Key findings
- Three vulnerabilities in Siyuan Note disclosed together, affecting versions prior to v3.8.2.
- Critical stored XSS (CVE-2026-84803) due to incomplete extension blocklist in asset serving.
- High-severity path traversal (CVE-2026-85175) allows access to sensitive TLS/CA keys.
- High-severity plaintext API token logging (CVE-2026-85174) enables persistent admin access.
- All issues fixed in Siyuan Note v3.8.2; users urged to update immediately.
On September 2nd and 3rd, 2026, a batch of three vulnerabilities was disclosed for Siyuan Note, a popular note-taking application. The most severe of these, CVE-2026-84803, is a critical stored cross-site scripting (XSS) vulnerability. The other two, CVE-2026-85175 and CVE-2026-85174, are high-severity flaws related to path traversal and sensitive log information disclosure, respectively. All three vulnerabilities affect Siyuan Note versions prior to v3.8.2.
The critical stored XSS vulnerability, CVE-2026-84803, arises from an incomplete blocklist for file extensions in the asset serving component. This oversight allows attackers to upload files with extensions that are interpreted as executable media types, leading to the execution of arbitrary JavaScript in the context of other users. This could enable session hijacking, credential theft, or unauthorized actions within the application.
CVE-2026-85175, a high-severity path traversal vulnerability, stems from an incomplete blocklist in the IsForbiddenAbsPath() function within kernel/util/path_guard.go. While the function blocks conf/conf.json by exact match, it fails to restrict access to sensitive files like TLS private keys (conf/key.pem) or CA private keys (conf/ca.key) stored in the same configuration directory. This could allow attackers to access or exfiltrate these critical security credentials.
The third high-severity vulnerability, CVE-2026-85174, involves the plaintext logging of API tokens. When full-text search requests exceed certain timing thresholds, Siyuan Note logs these tokens to an accessible log file. Authenticated attackers who can read this log file, potentially through the getFile endpoint, can recover administrative API tokens, granting them persistent administrative access to the Siyuan Note instance.
All three vulnerabilities were addressed in Siyuan Note version v3.8.2. Users are strongly advised to update to this version or later to mitigate these security risks. The disclosure of these vulnerabilities together highlights the importance of timely patching and security updates for applications handling sensitive user data and credentials.
The coordinated disclosure of these three vulnerabilities underscores the need for Siyuan Note users to maintain up-to-date installations. The critical XSS and high-severity path traversal and token disclosure flaws present significant risks, including unauthorized access and potential compromise of sensitive information. Promptly applying the v3.8.2 update is crucial for safeguarding user data and maintaining the integrity of Siyuan Note instances.