ETK-2026-1458Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-1458",
  "cve_id": null,
  "display_id": "ETK-2026-1458",
  "ghsa_id": "GHSA-gg3p-r4g8-vxg2",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Windows device-path validation bypass in SiYuan kernel",
  "summary": "SiYuan on Windows mishandles device-namespace path aliases when deciding whether an import source is sensitive. An attacker able to submit import requests can bypass that check and cause sensitive local files to be copied into assets that may be accessible over HTTP, exposing material such as instance credentials or TLS keys.",
  "mitigation": "Upgrade SiYuan to v3.8.7 or later. Until upgraded, restrict access to import functionality and avoid exposing Windows-hosted instances to untrusted users or networks.",
  "vendor": "go",
  "product": "go:github.com/siyuan-note/siyuan",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.5.4"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "v3.8.7"
      ],
      "package_name": "siyuan-note/siyuan",
      "purl": "pkg:golang/siyuan-note/siyuan"
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 34.49780715,
  "t0_at": null,
  "signals": {
    "public_poc": {
      "at": "2026-10-13T05:22:48+00:00",
      "days": -7.978239613530093,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T04:51:27.924861+00:00",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gg3p-r4g8-vxg2"
    },
    "trigger_signal": {
      "at": "2026-10-13T05:22:48+00:00",
      "days": -7.978239613530093,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T04:51:27.924861+00:00",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gg3p-r4g8-vxg2"
    }
  }
}