SiYuan is a personal knowledge management system. Prior to 3.5.5, the /api/file/getFile endpoint uses case-sensitive string equality checks to block access to sensitive files. On case-insensitive file systems such as Windows, attackers can bypass restrictions using mixed-case paths and read protected configuration files. This vulnerability is fixed in 3.5.5.

Affected: Go: github.com/siyuan-note/siyuan/kernel

# File Read Interface Case Bypass Vulnerability ## Vulnerability Name File Read Interface Case Bypass Vulnerability

## Overview The `/api/file/getFile` endpoint uses **case-sensitive string equality checks** to block access to sensitive files. On case-insensitive file systems such as **Windows**, attackers can bypass restrictions using mixed-case paths and read protected configuration files.

## Impact - Read sensitive information in configuration files (e.g., access codes, API Tokens, sync configurations, etc.). - Remotely exploitable directly when the service is published without authentication.

## Trigger Conditions - Running on a **case-insensitive file system**. - The caller can access `/api/file/getFile` (via CheckAuth or Token injection in published services).

## PoC (Generic Example) After enabling publication:

**Request:** ```http POST /api/file/getFile Content-Type: application/json

{"path":"cOnf/conf.json"} ```

**Expected Result:** - Successfully return the content of the configuration file.

## Root Cause Path comparison uses strict case-sensitive string matching, without case normalization or identical file validation.

## Fix Recommendations - Normalize path casing before comparison (Windows/macOS). - Use file-level comparison methods such as `os.SameFile`. - Apply blacklist validation on sensitive paths **after case normalization**.

## Notes - Environment identifiers and sensitive information have been removed.

## Solution Commit `399a38893e8719968ea25…