Which versions of SiYuan are affected by CVE-2026-23850?

SiYuan versions prior to 3.5.4 contain a remote file read vulnerability in the markdown rendering engine that allows unauthenticated attackers to access arbitrary files from affected servers.. A patch is available.

Is there a public PoC exploit available for CVE-2026-23850?

Yes, a public proof-of-concept exploit is available for CVE-2026-23850. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-23850?

Within 24 hours: Identify all SiYuan deployments and confirm running versions. Within 7 days: Upgrade all SiYuan instances to version 3.5.4 or later. Within 30 days: Conduct file access audit to determine if vulnerability was exploited prior to patching; review access logs for suspicious markdown rendering requests.

SiYuan CVE-2026-23850

Q: What is the CVSS score of CVE-2026-23850?

CVE-2026-23850 has a CVSS 4.0 base score of 7.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

Path Traversal (CWE-22)

2026-01-19 security-advisories@github.com

GHSA-cv54-7wv7-qxcw

Path Traversal Siyuan

7.8

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 29, 2026 - 01:40 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 29, 2026 - 01:11 vuln.today

cvss_changed

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.5 (HIGH) 7.8 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 30, 2026 - 15:35 vuln.today

Public exploit code

Patch released

Jan 30, 2026 - 15:35 nvd

Patch available

CVE Published

Jan 19, 2026 - 20:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

SiYuan is a personal knowledge management system. In versions prior to 3.5.4, the markdown feature allows unrestricted server side html-rendering which allows arbitrary file read (LFD). Version 3.5.4 fixes the issue.

AnalysisAI

Remote attackers can read arbitrary files from SiYuan servers (versions prior to 3.5.4) by exploiting server-side HTML rendering in the markdown feature. The path traversal vulnerability (CWE-22) requires no authentication and has low attack complexity, making it trivially exploitable. A public exploit exists and EPSS scoring indicates 9% exploitation probability (25th percentile), suggesting limited but active reconnaissance. Vendor patch available in version 3.5.4.

Technical ContextAI

SiYuan is a personal knowledge management system that processes markdown content with server-side HTML rendering capabilities. The vulnerability stems from improper path validation (CWE-22: Path Traversal) in the file handling components, specifically in kernel/model/file.go and kernel/api/filetree.go. The markdown renderer fails to sanitize user-supplied file paths, allowing '../' sequences or absolute paths to escape intended directories. When markdown content is processed, the HTML renderer accesses files based on unsanitized input, enabling Local File Disclosure (LFD) attacks against the server filesystem. This affects the b3log:siyuan product line as identified by CPE cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*, with the flaw existing in the core kernel API and model layers responsible for file tree operations and markdown processing.

RemediationAI

Upgrade immediately to SiYuan version 3.5.4 or later, which contains patches documented in commits b2274baba2e11c8cf8901b0c5c871e5b27f1f6dd and f8f4b517077b92c90c0d7b51ac11be1b34b273ad per the vendor advisory at https://github.com/siyuan-note/siyuan/security/advisories/GHSA-cv54-7wv7-qxcw and tracked in issue #16860. SUSE customers should apply SUSE-SU-2026:0403 from https://www.suse.com/support/update/SUSE-SU-2026:0403/. If immediate patching is impossible, implement network-level access controls restricting SiYuan server access to authenticated users via reverse proxy with authentication (e.g., nginx with basic auth or OAuth), though this adds latency and user friction. Alternatively, disable markdown rendering features entirely if the knowledge base doesn't require rich formatting, though this degrades core functionality. Monitor web server access logs for suspicious requests containing '../' sequences, '..' encoded variants (%2e%2e), or access to sensitive paths like /etc/passwd or application config files. These mitigations reduce exposure but do not eliminate the vulnerability - patching remains the only complete solution.

More in Siyuan

View all

CVE-2024-53507 CRITICAL Act Now POC

9.8 Nov 29

A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), t

CVE-2024-53506 CRITICAL Act Now POC

9.8 Nov 29

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. R

CVE-2024-53505 CRITICAL Act Now POC

9.8 Nov 29

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated criti

CVE-2024-53504 CRITICAL Act Now POC

9.8 Nov 29

A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated c

CVE-2026-23852 CRITICAL Act Now POC

9.6 Jan 19

SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code ex

CVE-2026-54069 CRITICAL Act Now POC

9.2 Jun 24

Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chro

CVE-2026-29183 CRITICAL Act Now POC

9.3 Mar 06

Reflected XSS in SiYuan knowledge management before 3.5.9.

CVE-2026-25539 CRITICAL Act Now POC

9.1 Feb 04

SiYuan knowledge management system prior to 3.5.5 has a path traversal in /api/file/copyFile allowing arbitrary file ope

CVE-2024-2692 CRITICAL Act Now POC

9.0 Apr 04

SiYuan version 3.0.3 allows executing arbitrary commands on the server. Rated critical severity (CVSS 9.0), this vulnera

CVE-2026-29073 HIGH This Week POC

8.8 Mar 06

SQL injection in SiYuan prior to version 3.6.0 allows any authenticated user, including those with read-only access, to

CVE-2026-34605 HIGH This Week POC

8.6 Mar 31

Cross-site scripting (XSS) in SiYuan personal knowledge management system versions 3.6.0-3.6.1 allows remote attackers t

CVE-2026-54066 HIGH This Week POC

7.5 Jun 24

Arbitrary file disclosure in SiYuan personal knowledge management system before 3.7.0 lets an unauthenticated remote att

Same weakness CWE-22 – Path Traversal

View all

CVE-2019-3396 CRITICAL POC

9.8

CVE-2019-19781 CRITICAL POC

9.8

CVE-2020-5902 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2021-27065 HIGH POC

7.8

CVE-2019-11510 CRITICAL POC

10.0

CVE-2022-37042 CRITICAL POC

9.8

CVE-2022-30333 HIGH POC

7.5

Same technique Path Traversal

View all

CVE-2022-37042 CRITICAL POC

9.8

CVE-2025-64446 CRITICAL POC

9.8

CVE-2022-30333 HIGH POC

7.5

CVE-2022-27925 HIGH POC

7.2

CVE-2023-47246 CRITICAL POC

9.8

CVE-2015-0016 HIGH POC

7.8

CVE-2024-41713 CRITICAL POC

9.1

CVE-2016-0752 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: High

Product	Status
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.5	Fixed

CVE-2026-23850 vulnerability details – vuln.today

Back

SiYuan CVE-2026-23850

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Siyuan

Same weakness CWE-22 – Path Traversal

Same technique Path Traversal

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code