CVE-2026-85583
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Sep 04, 2026
Vendor
unknown
Description
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace and receive the target file bytes, bypassing workspace boundary restrictions.