A critical vulnerability in SiYuan versions 3.8.1 and earlier allows authenticated users to access sensitive private keys, potentially leading to full traffic decryption and certificate forgery.

The application utilizes an insufficient blocklist within the IsForbiddenAbsPath function, which fails to restrict access to sensitive files like TLS private keys (conf/key.pem) and CA keys (conf/ca.key). Because the getFile handler incorrectly assigns administrative privileges to all authenticated users, any user can retrieve these sensitive keys via the POST /api/file/getFile endpoint.

The compromise of TLS and CA private keys represents a severe security failure that undermines the confidentiality and integrity of all encrypted communication. An attacker possessing these keys can decrypt intercepted HTTPS traffic and issue fraudulent certificates that appear trusted by clients, resulting in significant data exposure, credential theft, and total loss of communication privacy. With a CVSS score of 8.8, this high severity vulnerability necessitates immediate attention to prevent lateral movement and broader system compromise.

Immediate Action: Upgrade to SiYuan version 3.8.2 or later to apply the necessary security patches and blocklist updates.

Proactive Monitoring: Review access logs for the /api/file/getFile endpoint, specifically monitoring for unauthorized or suspicious requests originating from standard user accounts.

Compensating Controls: Restrict network access to the SiYuan administrative interface and sensitive API endpoints using a Web Application Firewall or network segmentation to prevent exploitation by unauthorized actors.

Public Exploit Available: Unknown

Given the potential for total compromise of encrypted sessions and certificate authority integrity, organizations must prioritize upgrading to version 3.8.2 immediately. Ensure that the patch is applied across all instances of the application, particularly those with TLS enabled, to mitigate the risk of traffic interception and certificate forgery.