Description
SiYuan is a personal knowledge management system. Prior to 3.5.5, the /api/file/getFile endpoint uses case-sensitive string equality checks to block access to sensitive files. On case-insensitive file systems such as Windows, attackers can bypass restrictions using mixed-case paths and read protected configuration files. This vulnerability is fixed in 3.5.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| siyuan-note | siyuan | < 3.5.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/siyuan-note/siyuan/kernel | <= 0.0.0-20260126094835-d5d10dd41b0c | — | GHSA-f72r-2h5j-7639 |
| Go | github.com/siyuan-note/siyuan/kernel | all versions | — | GO-2026-4386 |