Medium
5.9
SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias
CVE-2026-118680
First seen on SecPulse
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| siyuan-notesiyuan |
3.8.7 – 3.8.8→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke importStdMd with a GLOBALROOT-prefixed path to copy the API token and TLS private key into the publicly served assets directory.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory github.com
- advisory vulncheck.com
- advisory nvd.nist.gov
- advisory github.com
- web github.com