CVE-2026-116171: SiYuan Sensitive-Path Denylist Bypass
A vulnerability in SiYuan 3.5.4 before 3.8.7 on Windows allows authenticated API callers to bypass the sensitive-path denylist and copy workspace configuration files, including API tokens and TLS private keys, into assets served to unauthenticated clients. This vulnerability has a CVSS score of 7.5 and is classified as HIGH severity.