{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asiyuansiyuanwindows/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:siyuan:siyuan:*:*:*:*:*:windows:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-116171"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SiYuan (\u003c 3.8.7)"],"_cs_severities":["high"],"_cs_tags":["path-traversal","security-bypass","credential-theft","vulnerability"],"_cs_type":"advisory","_cs_vendors":["SiYuan"],"content_html":"\u003cp\u003eSiYuan 3.5.4 through 3.8.6 on Windows contain a sensitive-path denylist bypass vulnerability within the IsSensitivePath function. The application fails to properly handle Windows extended-length path prefixes ('\\?'), allowing them to survive 'filepath.Clean' calls and evade security filters. An authenticated attacker can exploit this via the '/api/import/importStdMd' endpoint by prepending this prefix to the 'localPath' parameter, enabling the copying of workspace configuration files - including API tokens and TLS private keys - into asset directories accessible to unauthenticated users.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the unauthorized retrieval of sensitive configuration files, including credentials and cryptographic keys, from the SiYuan workspace. This can lead to full compromise of the application instance or unauthorized access to integrated services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade SiYuan to version 3.8.7 or later to resolve the improper path validation.\u003c/li\u003e\n\u003cli\u003eReview access logs for the '/api/import/importStdMd' endpoint to identify suspicious path traversal patterns or repeated requests containing '?'.\u003c/li\u003e\n\u003cli\u003eRotate API tokens and TLS private keys that may have been exposed through this vulnerability if an attacker is suspected of having accessed the workspace assets.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-25T14:32:11Z","date_published":"2026-10-25T14:32:11Z","id":"https://feed.craftedsignal.io/briefs/2026-10-siyuan-path-bypass/","summary":"SiYuan versions 3.5.4 through 3.8.6 on Windows contain a path denylist bypass vulnerability (CVE-2026-116171) that allows authenticated attackers to exfiltrate sensitive workspace files by prepending a Windows extended-length prefix to path parameters.","title":"SiYuan: Sensitive-path denylist bypass (CVE-2026-116171)","url":"https://feed.craftedsignal.io/briefs/2026-10-siyuan-path-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:siyuan:siyuan:*:*:*:*:*:windows:*:*","version":"https://jsonfeed.org/version/1.1"}