Siyuan
CVE-2026-25539
CRITICAL
GHSA-c4jr-5q7w-f6r9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as high-privilege user
-
DeliveryCall /api/file/copyFile endpoint
-
ExploitSpecify arbitrary destination path
-
ExecutionWrite malicious file to sensitive location
-
ImpactExecute arbitrary code
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated access to SiYuan prior to version 3.5.5 with high-privilege account (PR:H). Attacker must have valid credentials to access the /api/file/copyFile endpoint. Vulnerable to path traversal write operations on systems where web service has filesystem write permissions to cron directories, SSH config, or shell initialization files. |
| Impact | CVSS 9.1 with PoC and patch. Second SiYuan vulnerability (after CVE-2026-23852 XSS). File copy traversal can escalate to RCE by copying a web shell to accessible directories. |
| Exploit ScenarioDerived | An attacker uses the path traversal to copy a malicious script to a web-accessible directory, then executes it to gain server-side code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
SiYuan knowledge management system prior to 3.5.5 has a path traversal in /api/file/copyFile allowing arbitrary file operations on the server.
Earlier versions of this analysis (1)
Path traversal in SiYuan file copy API enables arbitrary file operations.
RemediationAI
Update SiYuan to 3.5.5+.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SiYuan < 3.5.5 has a CWE-22 path traversal in the /api/file/copyFile endpoint that allows authenticated users to copy files to/from arbitrary locations on the server.
Know when Siyuan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
SiYuan is a personal knowledge management system. Prior to version 3.5.5, the /api/file/copyFile endpoint does not validate the dest parameter, allowing authenticated users to write files to arbitrary locations on the filesystem. This can lead to Remote Code Execution (RCE) by writing to sensitive locations such as cron jobs, SSH authorized_keys, or shell configuration files. This issue has been patched in version 3.5.5.
Executive ViewAI
A critical vulnerability in SiYuan versions prior to 3.5.5 allows authenticated users to write files anywhere on affected systems, potentially enabling data theft, malware deployment, or system compromise. Any organization using SiYuan for knowledge management faces immediate risk of unauthorized data access and operational disruption.
Apply vendor patch. If immediate patching is not possible: (1) Disable the /api/file/copyFile endpoint via web application firewall or reverse proxy rules; (2) Restrict SiYuan network access to VPN/trusted networks only; (3) Implement strict file system permissions to limit write access; (4) Monitor file system changes for unauthorized writes to critical directories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)GitHub Advisory
SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements
SQL injection in SiYuan personal knowledge-management software (all versions before v3.7.3) lets attackers inject arbitr
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. Rated critical severity (CVSS 9.8), t
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. R
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. Rated criti
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. Rated c
SiYuan personal knowledge management system prior to 3.5.4 has a stored XSS vulnerability (CVSS 9.6) that allows code ex
Remote code execution in SiYuan note-taking application (before v3.6.1) allows any malicious Bazaar marketplace package
Origin-validation bypass in SiYuan Note (open-source personal knowledge management) before 3.7.0 lets any installed Chro
Reflected XSS in SiYuan knowledge management before 3.5.9.
SiYuan version 3.0.3 allows executing arbitrary commands on the server. Rated critical severity (CVSS 9.0), this vulnera
An authenticated ZipSlip path-traversal flaw in SiYuan's notes import feature (importZipMd) lets any credentialed user w
Exploit-DB