CVE-2026-126264

CVSS 8.3 (high) · published 2026-11-13

SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve credential-named widget files by bypassing the sensitive-path guard in getFile. Attackers can request paths like /data/widgets/<package>/credentials.json for publish-referenced widgets to obtain API keys, tokens, or other stored secrets.

Weakness: CWE-200

Source: NVD CVE-2026-126264

References

• https://github.com/siyuan-note/siyuan/commit/d122dee55e8d3c77de313d0ad6efae8b6b0ebc07
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3pm7-cc76-7j2p
• https://www.vulncheck.com/advisories/siyuan-before-3.8.9-sensitive-file-disclosure-via-api-file-getfile

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.