PT-2026-3496 · Siyuan · Siyuan

Abdoghazy2015 + 1 · Published 2026-01-19 · Updated 2026-02-06 · CVE-2026-23850

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.5.4

Description The markdown feature in SiYuan allows unrestricted server-side HTML rendering, which can lead to arbitrary file read (LFD) and Server-Side Request Forgery (SSRF). This issue occurs because the markdown parameter is passed to the model.CreateWithMarkdown function without proper sanitization. The input is then passed to luteEngine.Md2BlockDOM(md, false) without sanitization as well. An attacker can exploit this to read sensitive files from the system and potentially access internal hosts via SSRF. A proof-of-concept (PoC) exploit is available.

Recommendations Update SiYuan to version 3.5.4 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-23850

GHSA-CV54-7WV7-QXCW

GO-2026-4347

SUSE-SU-2026:0403-1

Affected Products

Siyuan

References · 93

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23850.json · Exploit
• https://github.com/siyuan-note/siyuan/commit/b2274baba2e11c8cf8901b0c5c871e5b27f1f6dd · Patch
• https://github.com/siyuan-note/siyuan/commit/f8f4b517077b92c90c0d7b51ac11be1b34b273ad · Patch
• https://github.com/siyuan-note/siyuan/issues/16860 · Patch
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-cv54-7wv7-qxcw · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cv54-7wv7-qxcw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23850 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4347 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23850 · Security Note
• https://github.com/siyuan-note/siyuan · Note
• https://github.com/siyuan-note/siyuan/blob/master/kernel/model/file.go#L1035 · Note
• https://github.com/siyuan-note/siyuan/blob/v3.4.2/kernel/api/filetree.go#L799-L886 · Note
• https://suse.com/security/cve/CVE-2026-24514 · Note
• https://suse.com/security/cve/CVE-2026-24117 · Note