Product
SiYuan versions 3.5.4 through 3.8.6 on Windows contain a path denylist bypass vulnerability (CVE-2026-116171) that allows authenticated attackers to exfiltrate sensitive workspace files by prepending a Windows extended-length prefix to path parameters.