GHSA-4wwp-f6gw-6qm5: SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)

October 5, 2026

IsForbiddenAbsPath() only blocks conf/conf.json by exact match. The TLS private key (conf/key.pem) and CA private key (conf/ca.key) live in the same conf/ directory and are absent from the blocklist. Any authenticated user can retrieve them via POST /api/file/getFile.

References

github.com/advisories/GHSA-4wwp-f6gw-6qm5
github.com/siyuan-note/siyuan/commit/256d73aa7f94aead7ba255b668e32c140af23137
github.com/siyuan-note/siyuan/releases/tag/v3.8.2
github.com/siyuan-note/siyuan/security/advisories/GHSA-4wwp-f6gw-6qm5

Code Behaviors & Features

Detect and mitigate GHSA-4wwp-f6gw-6qm5 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →