{"schema":"threatline.record/2","record":{"id":"CVE-2026-118680","aliases":["GHSA-gg3p-r4g8-vxg2"],"summary":"SiYuan 3.8.7 through 3.8.8 Path Traversal via GLOBALROOT Alias","details":"SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke importStdMd with a GLOBALROOT-prefixed path to copy the API token and TLS private key into the publicly served assets directory.","categories":["Unclassified"],"product":"siyuan","vendor":"siyuan-note","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118680","source_modified_at":"2026-10-28T18:59:51.831Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"siyuan","vendor":"siyuan-note","versions":[{"version":"3.8.7","status":"affected","versionType":"semver","lessThanOrEqual":"3.8.8"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":5.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T18:59:51.831Z","modified_at":"2026-10-28T18:59:51.831Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-118680","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T18:59:51.831Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gg3p-r4g8-vxg2","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/siyuan-3.8.7-through-3.8.8-path-traversal-via-globalroot-alias","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T18:59:51.831Z","content_hash":"1cb722c8258f2d0c1dcedcec21daec4091d72d8a6cff73dc4a233bcbae18467f"}}