Medium severity4.4NVD Advisory· Published Oct 28, 2026· Updated Oct 28, 2026

CVE-2026-118680

Description

SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke importStdMd with a GLOBALROOT-prefixed path to copy the API token and TLS private key into the publicly served assets directory.

Patches

Vulnerability mechanics

References

github.com/siyuan-note/siyuan/security/advisories/GHSA-gg3p-r4g8-vxg2nvd
www.vulncheck.com/advisories/siyuan-3.8.7-through-3.8.8-path-traversal-via-globalroot-aliasnvd

News mentions

No linked articles in our index yet.