SiYuan CVE-2025-67488

Exploitation requires (1) a valid authenticated SiYuan account that has access to the notes import functionality, and (2) the ability to upload a ZIP archive processed by importZipMd. Arbitrary file overwrite works against any writable path the service process can reach via ../ traversal entries. Escalation to full RCE is NOT automatic: it depends on overwriting a file that is later executed - the advisory's concrete path is the official Docker image's entrypoint.sh, which only runs attacker code after a container restart. Limiting factors: authentication (PR:L) narrows the attacker set to credentialed users, which for this single-/few-user self-hosted tool is often the operator; RCE further depends on deployment mode (Docker entrypoint or an equivalent auto-executed file) and on a restart occurring. Non-Docker deployments still face arbitrary file overwrite but the RCE path may differ or be unavailable.

This is a genuine but conditionally-gated priority rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) and the 8.8 base score describe a network-reachable, low-complexity flaw that requires only a low-privileged authenticated account (PR:L) and no user interaction, with full C/I/A impact driven by the ZipSlip-to-RCE escalation path. Publicly available exploit code exists (a working PoC ZIP generator is published in the GHSA advisory), which raises practical risk. However, the CVE is NOT in CISA KEV, so there is no confirmed active exploitation, and the EPSS score is low at 0.44% (37th percentile), consistent with a product that is not a mass-exploitation target. The key tension to flag: PR:L means exploitation presupposes the attacker already holds a valid account with access to the notes import feature - for a self-hosted single-user knowledge tool this is often the owner themselves, which sharply limits the realistic external-attacker population. Full RCE is further described as achievable only 'under some circumstances' (notably the official Docker image, by overwriting entrypoint.sh and awaiting a container restart), so the headline RCE outcome is conditional, not guaranteed. Net: real and exploit-code-backed, but the authentication requirement and conditional RCE path make it a high-severity issue with a narrow preconditions window rather than a wormable internet-wide threat.

An authenticated SiYuan user (or an attacker who has obtained valid credentials) crafts a malicious ZIP whose entries use path-traversal names like ../../../../opt/siyuan/entrypoint.sh and uploads it through the notes Markdown import feature, where the vulnerable importZipMd function extracts entries without sanitizing paths, overwriting the targeted file. A public PoC exists that generates exactly this ZIP; on the official Docker image the overwritten entrypoint.sh executes attacker-controlled code on the next container restart, yielding remote code execution.