A critical vulnerability in SiYuan prior to version 3.8.2 allows authenticated attackers to harvest administrative API tokens through insecure log files, leading to full unauthorized administrative control.

This flaw involves the insertion of sensitive information into log files (CWE-532), where API tokens are recorded in plaintext during specific full-text search operations. Any authenticated attacker can subsequently exploit this by accessing the logs via the getFile endpoint to escalate privileges to the administrative level.

The potential for full administrative account takeover represents a significant security risk, potentially leading to total system compromise, unauthorized data access, and loss of control over the application environment. Given the high CVSS score of 8.8, this vulnerability poses a severe threat to the confidentiality and integrity of the SiYuan instance, necessitating immediate remediation to prevent persistent unauthorized access.

Immediate Action: Upgrade the SiYuan installation to version 3.8.2 or later, which addresses the insecure logging behavior.

Proactive Monitoring: Review application access logs for unusual activity or repeated requests to the getFile endpoint that may indicate attempts to retrieve sensitive configuration files.

Compensating Controls: Restrict access to the application instance at the network level and implement strict role-based access control to ensure that only authorized personnel have access to the underlying server environment.

Public Exploit Available: No (exploit_available: false)

The vulnerability in SiYuan presents a high risk due to the potential for full administrative account takeover by authenticated users. Organizations should prioritize updating to version 3.8.2 immediately to eliminate the exposure of API tokens. Failure to patch leaves the system susceptible to persistent administrative compromise, which could have severe downstream impacts on data security and system integrity.