Verified

ghsa:GHSA-4WWP-F6GW-6QM5: github.com/siyuan-note/siyuan/kernel affected git revisions

SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist). Affected range: < 0.0.0-20260819144130-256d73aa7f94. Fixed version: 0.0.0-20260819144130-256d73aa7f94.

Affected technology

github.com/siyuan-note/siyuan/kernel · < 0.0.0-20260819144130-256d73aa7f94
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

Any authenticated user can retrieve them via POST `/api/file/getFile`. ### Root cause `kernel/util/path_guard.go`, `IsForbiddenAbsPath()` has no entry for TLS key material.

Published 12-Oct-2026 10:15 UTC

Product: github.com/siyuan-note/siyuan/kernel
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-05 23:10:51.172112+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-4wwp-f6gw-6qm5.html