The SiYuan Windows installer for versions 2.0.14 through 3.8.0 is vulnerable to local privilege escalation due to an uncontrolled search path element during the installation process.

This vulnerability is caused by an uncontrolled search path element (CWE-427) in the NSIS installer, which resolves system executables via the installer directory rather than the secure System32 path. A local, low-privileged user can exploit this during an all-users installation to execute malicious code with elevated system privileges.

Successful exploitation of this flaw allows a low-privileged user to gain full administrative control over the affected Windows host. Given the CVSS score of 7.0, this high-severity vulnerability poses a significant risk to system integrity and confidentiality, as an attacker could install persistent backdoors, steal sensitive credentials, or exfiltrate data from the compromised machine.

Immediate Action: Upgrade SiYuan Note to version 3.8.1 or later to resolve the search path vulnerability.

Proactive Monitoring: Review Windows security event logs for unexpected execution of system binaries from non-standard directories, particularly during software installation events.

Compensating Controls: Ensure that users perform software installations from protected directories where they do not have write access, which prevents the planting of malicious binaries by unauthorized local users.

Public Exploit Available: Unknown

This vulnerability represents a critical security risk for environments where SiYuan Note is deployed via elevated installers. Administrators must prioritize updating to version 3.8.1 immediately to prevent local privilege escalation. Users should avoid running installers from directories where untrusted local users have write permissions until the patch is applied.