CVE-2026-85583 [MEDIUM] – SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessi

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/assets/ that is a symlink to a file outside the workspace and receive the target file bytes, bypassing workspace boundary restrictions.