Medium severity · published Oct 28, 2026
CVE-2026-118680
SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias
New
4.4
CVSS
–
EPSS
No
On KEV
Description
SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke importStdMd with a GLOBALROOT-prefixed path to copy the API token and TLS private key into the publicly served assets directory.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
siyuan · siyuan-note
3.8.7 through 3.8.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118680
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118680
vendor-advisory
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gg3p-r4g8-vxg2
third-party-advisory
https://www.vulncheck.com/advisories/siyuan-3.8.7-through-3.8.8-path-traversal-via-globalroot-alias
More from siyuan
10.0
CVE-2026-72811
SiYuan before v3.7.4 SQL Injection via backlink search
10.0
CVE-2026-69085
SiYuan before v3.7.3 SQL Injection via searchDocs
10.0
CVE-2026-69084
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
10.0
CVE-2026-69083
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
10.0
CVE-2026-66012
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP