Which versions of SiYuan are affected by CVE-2026-23850?

SiYuan versions prior to 3.5.4 contain a remote file read vulnerability in the markdown rendering engine that allows unauthenticated attackers to access arbitrary files from affected servers.. A patch is available.

Is there a public PoC exploit available for CVE-2026-23850?

Yes, a public proof-of-concept exploit is available for CVE-2026-23850. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-23850?

Within 24 hours: Identify all SiYuan deployments and confirm running versions. Within 7 days: Upgrade all SiYuan instances to version 3.5.4 or later. Within 30 days: Conduct file access audit to determine if vulnerability was exploited prior to patching; review access logs for suspicious markdown rendering requests.

SiYuan CVE-2026-23850

Q: What is the CVSS score of CVE-2026-23850?

CVE-2026-23850 has a CVSS 4.0 base score of 7.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

Path Traversal (CWE-22)

2026-01-19 security-advisories@github.com

GHSA-cv54-7wv7-qxcw

Path Traversal Siyuan

7.8

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 29, 2026 - 01:40 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 29, 2026 - 01:11 vuln.today

cvss_changed

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.5 (HIGH) 7.8 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 30, 2026 - 15:35 vuln.today

Public exploit code

Patch released

Jan 30, 2026 - 15:35 nvd

Patch available

CVE Published

Jan 19, 2026 - 20:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

SiYuan is a personal knowledge management system. In versions prior to 3.5.4, the markdown feature allows unrestricted server side html-rendering which allows arbitrary file read (LFD). Version 3.5.4 fixes the issue.

AnalysisAI

Remote attackers can read arbitrary files from SiYuan servers (versions prior to 3.5.4) by exploiting server-side HTML rendering in the markdown feature. The path traversal vulnerability (CWE-22) requires no authentication and has low attack complexity, making it trivially exploitable. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Access SiYuan web interface

Delivery

Craft markdown with path traversal payload

Exploit

Submit to rendering endpoint

Execution

Server processes unsanitized path

Persist

Read arbitrary file content

Impact

Exfiltrate sensitive data

Access

Access SiYuan web interface

Delivery

Craft markdown with path traversal payload

Exploit

Submit to rendering endpoint

Execution

Server processes unsanitized path

Persist

Read arbitrary file content

Impact

Exfiltrate sensitive data

Vulnerability AssessmentAI

Exploitation	No special conditions - remote unauthenticated exploitation against default configurations of SiYuan versions prior to 3.5.4. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Real-world risk is MODERATE despite the 7.8 CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated remote attacker crafts a malicious markdown document containing path traversal sequences in file reference syntax, then submits it to the SiYuan server's markdown rendering endpoint. The server-side HTML renderer processes the document without validating file paths, allowing the attacker to read arbitrary files such as /etc/passwd, application configuration files containing credentials, or proprietary knowledge base content. …
Remediation	Upgrade immediately to SiYuan version 3.5.4 or later, which contains patches documented in commits b2274baba2e11c8cf8901b0c5c871e5b27f1f6dd and f8f4b517077b92c90c0d7b51ac11be1b34b273ad per the vendor advisory at https://github.com/siyuan-note/siyuan/security/advisories/GHSA-cv54-7wv7-qxcw and tracked in issue #16860. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all SiYuan deployments and confirm running versions. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Vendor StatusVendor

SUSE

Severity: High

Product	Status
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.5	Fixed

CVE-2026-23850 vulnerability details – vuln.today

Back

SiYuan CVE-2026-23850

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code