SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)

{
  "id": "902a6dcb0504591b5138312d8a93b89add434d5bae4fffd07a134548b94f2d06",
  "url": "https://osv.dev/vulnerability/GHSA-4wwp-f6gw-6qm5",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)",
    "summary": "### Summary: `IsForbiddenAbsPath()` only blocks `conf/conf.json` by exact match. The TLS private key (conf/key.pem) and CA private key (conf/ca.key) live in the same conf/ directory and are absent from the blocklist. Any authenticated user can retrieve them via POST `/api/file/getFile`. ### Root cause `kernel/util/path_guard.go`, `IsForbiddenAbsPath()` has no entry for TLS key material. The `getFile` handler at kernel/api/file.go:497 skips the blocklist for RoleAdministrator, and in v3.8.1 all authenticated users receive RoleAdministrator (no non-admin role is currently issued to direct API consumers). The files are generated on every boot regardless of whether TLS is active. ### Steps to reproduce: ``` # No token required on a default no-auth-code instance curl -s -X POST http://TARGET:6806/api/file/getFile \\ -H \"Content-Type: application/json\" \\ -d '{\"path\": \"/conf/key.pem\"}' ``` ``` curl -s -X POST http://TARGET:6806/api/file/getFile \\ -H \"Content-Type: application/json\" \\ -d '{\"path\": \"/conf/ca.key\"}' ``` **Response:** Raw PEM private key bytes. ### Impact: On deployments with TLS enabled (--ssl flag or NetworkServeTLS), possession of `key.pem` allows decryption of captured HTTPS traffic. Possession of `ca.key` allows signing certificates trusted by any client that imported SiYuan's locaprompts users to do). The files exist on every installation even whenTLS is currently inactive. ### Prior art: This is the same class of bug as GHSA-9jfx-rc58-h23j (conf.json readable via ",
    "evidence": "osv:GHSA-4wwp-f6gw-6qm5",
    "products": [
      {
        "name": {
          "value": "github.com/siyuan-note/siyuan/kernel",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.0.0-20260819144130-256d73aa7f94",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "GHSA-4wwp-f6gw-6qm5",
      "aliases": [
        "CVE-2026-85175",
        "GHSA-4wwp-f6gw-6qm5",
        "GO-2026-6663"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.0.0-20260819144130-256d73aa7f94"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/siyuan-note/siyuan/kernel",
            "purl": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-4wwp-f6gw-6qm5/GHSA-4wwp-f6gw-6qm5.json"
          }
        }
      ],
      "modified": "2026-10-07T17:55:53.527130104Z",
      "provider": "osv",
      "references": [
        "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4wwp-f6gw-6qm5",
        "https://github.com/siyuan-note/siyuan/commit/256d73aa7f94aead7ba255b668e32c140af23137",
        "https://github.com/siyuan-note/siyuan",
        "https://github.com/siyuan-note/siyuan/releases/tag/v3.8.2"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-552"
        ],
        "severity": "MODERATE",
        "github_reviewed": true,
        "nvd_published_at": null,
        "github_reviewed_at": "2026-10-05T17:32:48Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-85175",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 97134,
  "published_at": "2026-10-05T17:32:48+00:00"
}

{
  "id": "7374d050ebaf06f59acd0f3114a9676c2031978e77f5bdffc05adceb843e0527",
  "url": "https://osv.dev/vulnerability/GO-2026-6663",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist) in github.com/siyuan-note/siyuan/kernel",
    "summary": "SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist) in github.com/siyuan-note/siyuan/kernel",
    "evidence": "osv:GO-2026-6663",
    "products": [
      {
        "name": {
          "value": "github.com/siyuan-note/siyuan/kernel",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.0.0-20260819144130-256d73aa7f94",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "GO-2026-6663",
      "aliases": [
        "CVE-2026-85175",
        "GHSA-4wwp-f6gw-6qm5",
        "GO-2026-6663"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.0.0-20260819144130-256d73aa7f94"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/siyuan-note/siyuan/kernel",
            "purl": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://vuln.go.dev/ID/GO-2026-6663.json"
          },
          "ecosystem_specific": {}
        }
      ],
      "modified": "2026-10-07T17:55:53.527130104Z",
      "provider": "osv",
      "references": [
        "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4wwp-f6gw-6qm5",
        "https://github.com/siyuan-note/siyuan/commit/256d73aa7f94aead7ba255b668e32c140af23137",
        "https://github.com/siyuan-note/siyuan/releases/tag/v3.8.2"
      ],
      "provider_metadata": {
        "url": "https://pkg.go.dev/vuln/GO-2026-6663",
        "review_status": "UNREVIEWED"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-85175",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 97135,
  "published_at": "2026-10-07T14:10:39+00:00"
}