CVE-2026-126264

EUVD-2026-125257
SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve credential-named widget files by bypassing the sensitive-path guard in getFile. Attackers can request paths like /data/widgets/<package>/credentials.json for publish-referenced widgets to obtain API keys, tokens, or other stored secrets.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.7 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 41.41%
Common Weakness Enumeration
References
https://github.com/siyuan-note/siyuan/commit/d122dee55e8d3c77de313d0ad6efae8b6b0ebc07
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3pm7-cc76-7j2p
https://www.vulncheck.com/advisories/siyuan-before-3.8.9-sensitive-file-disclosure-via-api-file-getfile