PT-2025-50252 · Siyuan · Siyuan

Published 2025-12-09 · Updated 2026-01-06 · CVE-2025-67488

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiYuan versions 0.0.0 through 20251202123337-6ef83b42c7ce

Description SiYuan is a self-hosted, open source personal knowledge management software. Versions 0.0.0 through 20251202123337-6ef83b42c7ce contain a flaw in the importZipMd function that allows for ZipSlips. An authenticated user with access to the import functionality in notes can overwrite files on the system, potentially leading to full code execution in some cases.

Recommendations Update to version 3.5.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-67488

GHSA-GQFV-G4V7-M366

GO-2025-4221

SUSE-SU-2026:0037-1

Affected Products

Siyuan

References · 85

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67488.json · Exploit
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gqfv-g4v7-m366 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4221 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67488 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67488 · Vendor Advisory
• https://github.com/siyuan-note/siyuan/blob/dae6158860cc704e353454565c96e874278c6f47/kernel/api/import.go#L190 · Note
• https://suse.com/security/cve/CVE-2025-8110 · Note
• https://suse.com/security/cve/CVE-2025-54410 · Note
• https://suse.com/security/cve/CVE-2025-65754 · Note
• https://suse.com/security/cve/CVE-2025-66565 · Note
• https://suse.com/security/cve/CVE-2025-68940 · Note
• https://suse.com/security/cve/CVE-2025-67717 · Note
• https://suse.com/security/cve/CVE-2025-68113 · Note
• https://suse.com/support/update/announcement/2026/suse-su-20260037-1 · Note