SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*

{
  "id": "fac5f5c19c78c3454c425563f74e92cbb09b6e8b88eea4a4c329616da3d4f557",
  "url": "https://osv.dev/vulnerability/GHSA-3cm4-ccvw-6xr6",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*",
    "summary": "### Summary `GHSA-c8r8-95hg-mp34` added a centralized guard, `util.IsForbiddenAbsPath()`, specifically to block access to a small set of sensitive files: `conf/conf.json` (plaintext `accessAuthCode`/API token/cookie key), `data/snippets/conf.json`, the entire `data/templates/` directory, and `data/.siyuan/publishAccess.json` (plaintext publish-mode passwords). It was applied to `kernel/api/file.go` and `kernel/mcp/tools/file.go`. Two other routes in the same server that serve arbitrary files by path, `/history/*path` and `/repo/diff/*path`, construct their target paths independently and were not updated to call this new guard. Since the repo/history snapshot system's tracked root is `data/` (confirmed by `getSyncIgnoreLines()`, whose ignore file lives at `data/.siyuan/syncignore` with entries relative to `data/`), both `data/.siyuan/publishAccess.json` and `data/templates/*` fall within the scope that can legitimately be captured in historical snapshots, meaning a prior version of either file can exist in `util.HistoryDir`/the repo-diff temp checkout even after the live file has been protected by the new guard. This is CWE-862 (Missing Authorization) applied to a very recently introduced protection mechanism. ### Details `kernel/server/serve.go`, `/history/*path` (around line 994): ```go ginServer.GET(\"/history/*path\", model.CheckAuth, model.CheckAdminRole, func(context *gin.Context) { p := filepath.Join(util.HistoryDir, context.Param(\"path\")) // 加密笔记本的历史是密文（.sy/assets/AV），需先",
    "evidence": "osv:GHSA-3cm4-ccvw-6xr6",
    "products": [
      {
        "name": {
          "value": "github.com/siyuan-note/siyuan/kernel",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.0.0-20260816034002-035bf9a8c311",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "GHSA-3cm4-ccvw-6xr6",
      "aliases": [
        "CVE-2026-82651",
        "GHSA-3cm4-ccvw-6xr6",
        "GO-2026-6662"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.0.0-20260816034002-035bf9a8c311"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/siyuan-note/siyuan/kernel",
            "purl": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-3cm4-ccvw-6xr6/GHSA-3cm4-ccvw-6xr6.json"
          }
        }
      ],
      "modified": "2026-10-07T17:55:31.429031793Z",
      "provider": "osv",
      "references": [
        "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3cm4-ccvw-6xr6",
        "https://github.com/siyuan-note/siyuan/commit/035bf9a8c311c6f8468f2f1054b4d5e1711787e2",
        "https://github.com/siyuan-note/siyuan",
        "https://github.com/siyuan-note/siyuan/releases/tag/v3.8.1"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-200",
          "CWE-862"
        ],
        "severity": "MODERATE",
        "github_reviewed": true,
        "nvd_published_at": null,
        "github_reviewed_at": "2026-10-05T17:32:44Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-82651",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 97115,
  "published_at": "2026-10-05T17:32:44+00:00"
}

{
  "id": "1e1d10cebc6bd88d6d5eff948fb2ca08f05a14547da11f7e618f71a5094b0a07",
  "url": "https://osv.dev/vulnerability/GO-2026-6662",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/* in github.com/siyuan-note/siyuan/kernel",
    "summary": "SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/* in github.com/siyuan-note/siyuan/kernel",
    "evidence": "osv:GO-2026-6662",
    "products": [
      {
        "name": {
          "value": "github.com/siyuan-note/siyuan/kernel",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.0.0-20260816034002-035bf9a8c311",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "GO-2026-6662",
      "aliases": [
        "CVE-2026-82651",
        "GHSA-3cm4-ccvw-6xr6",
        "GO-2026-6662"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.0.0-20260816034002-035bf9a8c311"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/siyuan-note/siyuan/kernel",
            "purl": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://vuln.go.dev/ID/GO-2026-6662.json"
          },
          "ecosystem_specific": {}
        }
      ],
      "modified": "2026-10-07T17:55:31.429031793Z",
      "provider": "osv",
      "references": [
        "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3cm4-ccvw-6xr6",
        "https://github.com/siyuan-note/siyuan/commit/035bf9a8c311c6f8468f2f1054b4d5e1711787e2",
        "https://github.com/siyuan-note/siyuan/releases/tag/v3.8.1"
      ],
      "provider_metadata": {
        "url": "https://pkg.go.dev/vuln/GO-2026-6662",
        "review_status": "UNREVIEWED"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-82651",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 97117,
  "published_at": "2026-10-07T14:10:39+00:00"
}