CVE-2026-82651: SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-30 · updated 2026-08-31
Weakness: CWE-200

Description

SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can retrieve historical snapshots of sensitive files that the guard is meant to block, including data/.siyuan/publishAccess.json (plaintext publish-mode passwords) and files under data/templates/.

Affected products

Go Github.Com/Siyuan-Note/Siyuan/Kernel: before 0.0.0-20260816034002-035bf9a8c311 — fixed in 0.0.0-20260816034002-035bf9a8c311
siyuan-note siyuan: before 3.8.1 — fixed in 3.8.1

How to fix

Upgrade to a fixed version: Go Github.Com/Siyuan-Note/Siyuan/Kernel 0.0.0-20260816034002-035bf9a8c311; siyuan-note siyuan 3.8.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-82651 or the next vulnerability affects your stack