Vulnerability · Published Oct 28, 2026 · Assigned by VulnCheck
CVE-2026-118680SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias
Medium 4.4
In plain English
A medium-severity path traversal in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.5%top 60.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke importStdMd with a GLOBALROOT-prefixed path to copy the API token and TLS private key into the publicly served assets directory.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| siyuan-note | siyuan | 3.8.7 – through 3.8.8 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
References
- GitHub Security Advisory (GHSA-gg3p-r4g8-vxg2) vendor-advisory
- VulnCheck Advisory: SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias third-party-advisory