CVE-2026-85174 SiYuan before v3.8.2 API Token Exposure via Log File
Authenticated attackers can read admin API tokens from log files to gain permanent administrative access in SiYuan.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85174?
CVE-2026-85174 is a high-severity vulnerability in siyuan-note siyuan, published on 3 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access.
Weakness: CWE-532
Which versions are affected by CVE-2026-85174?
How do I fix CVE-2026-85174?
No fix has been published for CVE-2026-85174 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-85174 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-85174 exists.
Sources
Also known as GHSA-3wvc-5754-gp67, GHSA-gw65-q899-j639.