{"schema":"threatline.record/2","record":{"id":"GHSA-4wwp-f6gw-6qm5","aliases":["CVE-2026-85175","GHSA-4wwp-f6gw-6qm5","GO-2026-6663"],"summary":"SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)","details":"### Summary:\n`IsForbiddenAbsPath()` only blocks `conf/conf.json` by exact match. The TLS private key (conf/key.pem) and CA private key (conf/ca.key) live in the same conf/ directory and are absent from the blocklist. Any authenticated user can retrieve them via POST `/api/file/getFile`.\n\n### Root cause\n`kernel/util/path_guard.go`, `IsForbiddenAbsPath()` has no entry for TLS key material. The `getFile` handler at kernel/api/file.go:497 skips the blocklist for RoleAdministrator, and in v3.8.1 all authenticated users receive RoleAdministrator (no non-admin role is currently issued to direct API consumers). The files are generated on every boot regardless of whether TLS is active.\n\n### Steps to reproduce:\n```\n# No token required on a default no-auth-code instance\ncurl -s -X POST http://TARGET:6806/api/file/getFile \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"path\": \"/conf/key.pem\"}'\n```\n```\ncurl -s -X POST http://TARGET:6806/api/file/getFile \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"path\": \"/conf/ca.key\"}'\n```\n\n**Response:** Raw PEM private key bytes.\n\n<img width=\"927\" height=\"467\" alt=\"2026-08-19_14-19\" src=\"https://github.com/user-attachments/assets/12e0787f-6bfc-416a-b5ad-a22954e45c48\" />\n\n### Impact:\nOn deployments with TLS enabled (--ssl flag or NetworkServeTLS), possession of `key.pem` allows decryption of captured HTTPS traffic. Possession of `ca.key` allows signing certificates trusted by any client that imported SiYuan's locaprompts users to do). The files exist on every installation even whenTLS is currently inactive.\n\n### Prior art: \nThis is the same class of bug as GHSA-9jfx-rc58-h23j (conf.json readable via template render) and GHSA-c8r8-95hg-mp34 (MCP file tool blocklist incomplete). The fix is to add `conf/key.pem`, `conf/ca.key`, `conf/cert.pem`, and `conf/ca.crt` to `IsForbiddenAbsPath()`.","categories":["Libraries & packages"],"product":"github.com/siyuan-note/siyuan/kernel","vendor":"","ecosystem":"go","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-4wwp-f6gw-6qm5","source_modified_at":"2026-10-05T17:32:48Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/siyuan-note/siyuan/kernel"},"range":"< 0.0.0-20260819144130-256d73aa7f94"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-4wwp-f6gw-6qm5","source_modified_at":"2026-10-07T17:55:53.527130104Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"github.com/siyuan-note/siyuan/kernel","ecosystem":"Go","purl":"pkg:golang/github.com/siyuan-note/siyuan/kernel"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260819144130-256d73aa7f94"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-4wwp-f6gw-6qm5","source_modified_at":"2026-10-05T17:32:48Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/siyuan-note/siyuan/kernel"},"version":"0.0.0-20260819144130-256d73aa7f94"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-4wwp-f6gw-6qm5","source_modified_at":"2026-10-07T17:55:53.527130104Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"github.com/siyuan-note/siyuan/kernel","ecosystem":"Go","purl":"pkg:golang/github.com/siyuan-note/siyuan/kernel"},"version":"0.0.0-20260819144130-256d73aa7f94"}],"cvss":null,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-05T17:32:48Z","modified_at":"2026-10-07T17:55:53.527130104Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-4wwp-f6gw-6qm5","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-05T17:32:48Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-4wwp-f6gw-6qm5","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-07T17:55:53.527130104Z"}],"sources":["GitHub Advisory Database","OSV"],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4wwp-f6gw-6qm5","source":"GitHub Advisory Database"},{"url":"https://github.com/siyuan-note/siyuan/commit/256d73aa7f94aead7ba255b668e32c140af23137","source":"GitHub Advisory Database"},{"url":"https://github.com/siyuan-note/siyuan/releases/tag/v3.8.2","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-4wwp-f6gw-6qm5","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-07T17:55:53.527130104Z","content_hash":"815af257d0d8cbee274f8d530e2053ef9d0ab3fd9bf682476e509d5a60b836d1"}}