Description

SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-03T13:06:25.123Z",
  "pubdate": "2026-09-03T13:06:25.123Z",
  "executiveSummary": "A sensitive information disclosure vulnerability exists in SiYuan versions prior to 3.8.2, stemming from insecure logging practices during full-text search operations.\nThe application inadvertently records plaintext API tokens present in query parameters into accessible log files when search requests exceed internal timing thresholds.\nThis vulnerability allows an authenticated attacker to leverage the 'getFile' endpoint to retrieve these logs, effectively extracting administrative credentials.\nSuccessful exploitation results in total compromise of the application, as the recovered API tokens grant permanent administrative access, bypassing standard authentication controls.\nThe risk is critical due to the persistent nature of the stolen credentials, which remain valid even after the initial session terminates.\nExploitation requires authenticated access to the system, making this an escalation-of-privilege vector for users with standard access levels.",
  "technicalDetails": "The root cause of the vulnerability lies in an improper logging mechanism within the full-text search module of the SiYuan application. When a search request is processed, the application includes the full request context, including URL query parameters, in internal log files if the execution latency surpasses a predefined threshold.\nBecause the API token is passed via query parameters during certain request types, the application erroneously logs the sensitive token in cleartext format. These logs are stored in a file system location that is reachable via the application's 'getFile' endpoint.\nThe attack flow begins with the adversary performing a specific full-text search request designed to trigger the application's slow-query logging logic. By intentionally inducing timing delays, the attacker ensures the request metadata—containing the authentication token—is persisted to the log file.\nOnce the logs have been populated with the sensitive data, the attacker exploits the 'getFile' endpoint, which is designed for file access, to download or view the contents of the log file. Since the application fails to restrict access to this endpoint regarding sensitive system logs, the attacker gains direct read access to the plaintext token.\nThe impact is significant: the retrieved token serves as a permanent administrative credential. An attacker possessing this token can authenticate directly to the API with elevated privileges, effectively assuming the identity of the administrator. This grants the attacker full control over the SiYuan instance, including data exfiltration, manipulation, and administrative configuration changes.\nThe vulnerability affects all SiYuan versions prior to 3.8.2. It is characterized as a failure to sanitize input and control sensitive information flow, specifically targeting the inadvertent exposure of credentials in non-volatile storage or accessible system files."
}