Is CVE-2026-85580 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-85580?

CVE-2026-85580 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-85580

Description

SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive publish-access configuration and metadata.