Description
SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke importStdMd with a GLOBALROOT-prefixed path to copy the API token and TLS private key into the publicly served assets directory.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| siyuan-note | siyuan | 3.8.7 – ≤ 3.8.8 | — |
References
- GitHub Security Advisory (GHSA-gg3p-r4g8-vxg2) vendor-advisory
- VulnCheck Advisory: SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias third-party-advisory