CVE-2026-126264
HIGH
NVD
CVSS Score
7.7
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve credential-named widget files by bypassing the sensitive-path guard in getFile. Attackers can request paths like /data/widgets/<package>/credentials.json for publish-referenced widgets to obtain API keys, tokens, or other stored secrets.