Is CVE-2026-85583 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-85583?

CVE-2026-85583 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-85583

Description

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace and receive the target file bytes, bypassing workspace boundary restrictions.