CVE-2026-116171 SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix

Medium 5.9 Published 25 Oct 2026 Updated 28 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-116171?

CVE-2026-116171 is a medium-severity vulnerability in siyuan-note siyuan, published on 25 Oct 2026.

Official description

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the prefix to localPath in /api/import/importStdMd to copy workspace conf files, including the API token and TLS private keys, into assets served to unauthenticated clients.

Weakness: CWE-22

Which versions are affected by CVE-2026-116171?

How do I fix CVE-2026-116171?

No fix has been published for CVE-2026-116171 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116171 being exploited?

There is no known exploitation of CVE-2026-116171 in the wild and no public exploit code.

Sources

Also known as GHSA-6gmc-424x-xgpm, GHSA-6xx3-j82h-hmgh.