SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go), which only blocks conf/conf.json by exact match and does not restrict the TLS private key (conf/key.pem) or CA private key (conf/ca.key) stored in the same conf/ directory. Because the getFile handler skips the blocklist for RoleAdministrator and all authenticated users receive RoleAdministrator in v3.8.1, any user (or any client on a default no-auth-code instance) can retrieve these private keys via POST /api/file/getFile. On deployments with TLS enabled, this allows decryption of captured HTTPS traffic (key.pem) and forging of certificates trusted by clients that imported SiYuan's CA (ca.key).

SiYuan versions up to and including 3.8.1 contain a vulnerability in the IsForbiddenAbsPath() function within kernel/util/path_guard.go. The blocklist only restricts conf/conf.json by exact match, leaving TLS private key (conf/key.pem) and CA private key (conf/ca.key) accessible. The getFile handler bypasses the blocklist entirely for RoleAdministrator, and all authenticated users are granted RoleAdministrator in v3.8.1. This means any authenticated user, or any client on a default no-auth-code instance, can retrieve these sensitive private keys via POST /api/file/getFile. On TLS-enabled deployments, an attacker can use key.pem to decrypt captured HTTPS traffic and ca.key to forge trusted certificates. The vulnerability is fixed in SiYuan v3.8.2.