What is GHSA-6xx3-j82h-hmgh?

GHSA-6xx3-j82h-hmgh is a security advisory published by GitHub Security Advisories with High severity. SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath...

Which CVE IDs does GHSA-6xx3-j82h-hmgh cover?

GHSA-6xx3-j82h-hmgh covers the following CVE IDs: CVE-2026-116171. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6xx3-j82h-hmgh?

GHSA-6xx3-j82h-hmgh has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-6xx3-j82h-hmghHighCVSS 7.5

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath...

Vendor

GitHub Security Advisories

Published

October 25, 2026

Last Modified

October 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-116171 →

📋 Description

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\?) survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the prefix to localPath in /api/import/importStdMd to copy workspace conf files, including the API token and TLS private keys, into assets served to unauthenticated clients.

🔗 References (4)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6gmc-424x-xgpm
https://nvd.nist.gov/vuln/detail/CVE-2026-116171
https://www.vulncheck.com/advisories/siyuan-3.5.4-before-3.8.7-sensitive-path-bypass-via-windows-extended-length-prefix
https://github.com/advisories/GHSA-6xx3-j82h-hmgh