SiYuan versions before v3.8.2 contain a vulnerability where API tokens passed as query parameters are logged in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can exploit this by reading the log file through the getFile endpoint to recover admin API tokens. Successfully exploiting this vulnerability grants attackers permanent administrative access to the affected SiYuan instance. The issue is documented in CVE-2026-85174 and addressed in the v3.8.2 release. The vulnerability stems from improper handling of sensitive data in logging mechanisms, a common but serious security oversight. Mitigations involve upgrading to v3.8.2 or later.
