CVE-2026-116171 | siyuan-note SiYuan 3.5.4/3.8.6 Sensitive Path Denylist /api/import/importStdMd IsSensitivePath localPath information disclosure

October 25, 2026 Yanac

A vulnerability categorized as problematic has been discovered in siyuan-note SiYuan 3.5.4/3.8.6. Affected is the function IsSensitivePath of the file /api/import/importStdMd of the component Sensitive Path Denylist. Executing a manipulation of the argument localPath can lead to information disclosure.

This vulnerability appears as CVE-2026-116171. The attack may be performed from remote. There is no available exploit.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More