CVE-2026-85174

8.7 highEPSS 0.5%

High (8.7). EPSS 0.5% chance of exploitation in the next 30 days.

SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
CWE: CWE-532
Published: 2026-09-03
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3wvc-5754-gp67
https://www.vulncheck.com/advisories/siyuan-before-3.8.2-api-token-exposure-via-log-file
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3wvc-5754-gp67

Check your stack JSON