GHSA-4wwp-f6gw-6qm5: SiYuan TLS Private Keys Readable Vulnerability

MODERATE
Share
CWE-552
Published
Advisory Summary

GHSA-4wwp-f6gw-6qm5 is a MODERATE tls private keys readable vulnerability (CWE-552: Files or Directories Accessible to External Parties) affecting SiYuan libraries in the Go ecosystem. The issue involves tls private keys readable via getfile (incomplete blocklist). Remediation is available by upgrading affected packages to version 0.0.0-20260819144130-256d73aa7f94.

GHSA-4wwp-f6gw-6qm5 at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-4wwp-f6gw-6qm5
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-552: Files or Directories Accessible to External Parties
Affected Product SiYuan
Package Ecosystem Go
Published Date
Last Updated

How to Fix GHSA-4wwp-f6gw-6qm5

To remediate this vulnerability, upgrade all affected SiYuan dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/siyuan-note/siyuan/kernel fixed: 0.0.0-20260819144130-256d73aa7f94 
Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260819144130-256d73aa7f94
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/siyuan-note/siyuan/kernel

How to Check if You Are Affected

To determine whether your application is affected by GHSA-4wwp-f6gw-6qm5, inspect your project dependencies for SiYuan:

inspect dependencies for github.com/siyuan-note/siyuan/kernel

Analyze the terminal output to locate any version of SiYuan in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.0.0-20260819144130-256d73aa7f94), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-552: Files or Directories Accessible to External Parties, where the product makes files or directories accessible to unauthorized actors, even though they should not be. In SiYuan, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary: `IsForbiddenAbsPath()` only blocks `conf/conf.json` by exact match. The TLS private key (conf/key.pem) and CA private key (conf/ca.key) live in the same conf/ directory and are absent from the blocklist. Any authenticated user can retrieve them via POST `/api/file/getFile`. ### Root cause `kernel/util/path_guard.go`, `IsForbiddenAbsPath()` has no entry for TLS key material. The `getFile` handler at kernel/api/file.go:497 skips the blocklist for RoleAdministrator, and in v3.8.1 all authenticated users receive RoleAdministrator (no non-admin role is currently issued to direct API consumers). The files are generated on every boot regardless of whether TLS is active. ### Steps to reproduce: ``` # No token required on a default no-auth-code instance curl -s -X POST http://TARGET:6806/api/file/getFile \ -H "Content-Type: application/json" \ -d '{"path": "/conf/key.pem"}' ``` ``` curl -s -X POST http://TARGET:6806/api/file/getFile \ -H "Content-Type: application/json" \ -d '{"path": "/conf/ca.key"}' ``` **Response:** Raw PEM private key bytes. <img width="927" height="467" alt="2026-08-19_14-19" src="https://github.com/user-attachments/assets/12e0787f-6bfc-416a-b5ad-a22954e45c48" /> ### Impact: On deployments with TLS enabled (--ssl flag or NetworkServeTLS), possession of `key.pem` allows decryption of captured HTTPS traffic. Possession of `ca.key` allows signing certificates trusted by any client that imported SiYuan's locaprompts users to do). The files exist on every installation even whenTLS is currently inactive. ### Prior art: This is the same class of bug as GHSA-9jfx-rc58-h23j (conf.json readable via template render) and GHSA-c8r8-95hg-mp34 (MCP file tool blocklist incomplete). The fix is to add `conf/key.pem`, `conf/ca.key`, `conf/cert.pem`, and `conf/ca.crt` to `IsForbiddenAbsPath()`.

GHSA-4wwp-f6gw-6qm5 Affected SiYuan Versions

1 component(s)
Fixed Versions:
0.0.0-20260819144130-256d73aa7f94
Product / Package Ecosystem Affected Versions Fixed Version
github.com/siyuan-note/siyuan/kernel
golang/github.com/siyuan-note/siyuan/kernel
Go
< 0.0.0-20260819144130-256d73aa7f94
0.0.0-20260819144130-256d73aa7f94

References

GitHub Advisory / Wiki ADVISORY
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4wwp-f6gw-6qm5
Security Fix Commit FIX COMMIT
https://github.com/siyuan-note/siyuan/commit/256d73aa7f94aead7ba255b668e32c140af23137
SiYuan Source Repository REPOSITORY
https://github.com/siyuan-note/siyuan
SiYuan Release RELEASE
https://github.com/siyuan-note/siyuan/releases/tag/v3.8.2

Frequently Asked Questions

What is GHSA-4wwp-f6gw-6qm5?
GHSA-4wwp-f6gw-6qm5 is a security vulnerability in SiYuan involving TLS Private Keys Readable via getFile (Incomplete Blocklist) under CWE-552: Files or Directories Accessible to External Parties.
Which SiYuan versions are affected?
Affected versions include releases prior to 0.0.0-20260819144130-256d73aa7f94 across affected packages: github.com/siyuan-note/siyuan/kernel.
What version fixes GHSA-4wwp-f6gw-6qm5?
Upgrading to 0.0.0-20260819144130-256d73aa7f94 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/siyuan-note/siyuan/kernel affected?
Yes, github.com/siyuan-note/siyuan/kernel is affected in releases prior to 0.0.0-20260819144130-256d73aa7f94. Upgrade your dependency to 0.0.0-20260819144130-256d73aa7f94 or later.
What CWE is associated with GHSA-4wwp-f6gw-6qm5?
GHSA-4wwp-f6gw-6qm5 is classified under CWE-552: Files or Directories Accessible to External Parties (The product makes files or directories accessible to unauthorized actors, even though they should not be.).
How can I check Go dependencies for GHSA-4wwp-f6gw-6qm5?
Run the dependency tree command: 'inspect dependencies for github.com/siyuan-note/siyuan/kernel'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4wwp-f6gw-6qm5",
  "modified" : "2026-10-05T17:32:48Z",
  "published" : "2026-10-05T17:32:48Z",
  "aliases" : [ ],
  "summary" : "SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)",
  "details" : "### Summary:\n`IsForbiddenAbsPath()` only blocks `conf/conf.json` by exact match. The TLS private key (conf/key.pem) and CA private key (conf/ca.key) live in the same conf/ directory and are absent from the blocklist. Any authenticated user can retrieve them via POST `/api/file/getFile`.\n\n### Root cause\n`kernel/util/path_guard.go`, `IsForbiddenAbsPath()` has no entry for TLS key material. The `getFile` handler at kernel/api/file.go:497 skips the blocklist for RoleAdministrator, and in v3.8.1 all authenticated users receive RoleAdministrator (no non-admin role is currently issued to direct API consumers). The files are generated on every boot regardless of whether TLS is active.\n\n### Steps to reproduce:\n```\n# No token required on a default no-auth-code instance\ncurl -s -X POST http://TARGET:6806/api/file/getFile \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"path\": \"/conf/key.pem\"}'\n```\n```\ncurl -s -X POST http://TARGET:6806/api/file/getFile \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"path\": \"/conf/ca.key\"}'\n```\n\n**Response:** Raw PEM private key bytes.\n\n<img width=\"927\" height=\"467\" alt=\"2026-08-19_14-19\" src=\"https://github.com/user-attachments/assets/12e0787f-6bfc-416a-b5ad-a22954e45c48\" />\n\n### Impact:\nOn deployments with TLS enabled (--ssl flag or NetworkServeTLS), possession of `key.pem` allows decryption of captured HTTPS traffic. Possession of `ca.key` allows signing certificates trusted by any client that imported SiYuan's locaprompts users to do). The files exist on every installation even whenTLS is currently inactive.\n\n### Prior art: \nThis is the same class of bug as GHSA-9jfx-rc58-h23j (conf.json readable via template render) and GHSA-c8r8-95hg-mp34 (MCP file tool blocklist incomplete). The fix is to add `conf/key.pem`, `conf/ca.key`, `conf/cert.pem`, and `conf/ca.crt` to `IsForbiddenAbsPath()`.",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/siyuan-note/siyuan/kernel"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.0-20260819144130-256d73aa7f94"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4wwp-f6gw-6qm5"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/siyuan-note/siyuan/commit/256d73aa7f94aead7ba255b668e32c140af23137"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/siyuan-note/siyuan"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/siyuan-note/siyuan/releases/tag/v3.8.2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-552" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-10-05T17:32:48Z",
    "nvd_published_at" : null
  }
}