PT-2026-3497 · Siyuan · Siyuan

Jaroslaw-Wawiorko · Published 2026-01-19 · Updated 2026-02-06 · CVE-2026-23851

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.5.4

Description SiYuan is a personal knowledge management system with a logic issue in the /api/file/globalCopyFiles API endpoint. The issue allows authenticated users to copy files from any location on the server’s filesystem into the application’s workspace due to a lack of proper path validation. The vulnerable function, globalCopyFiles, accepts a list of source paths (srcs) from the JSON request body. While the code verifies file existence using filelock.IsExist(src), it does not confirm if the source path is within the authorized workspace directory. The vulnerability resides in the api/file.go source code.

Recommendations Update SiYuan to version 3.5.4 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-23851

GHSA-94C7-G2FJ-7682

GO-2026-4346

SUSE-SU-2026:0403-1

Affected Products

Siyuan

References · 91

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23851.json · Exploit
• https://github.com/siyuan-note/siyuan/commit/b2274baba2e11c8cf8901b0c5c871e5b27f1f6dd · Patch
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-94c7-g2fj-7682 · Patch
• https://github.com/siyuan-note/siyuan/commit/f8f4b517077b92c90c0d7b51ac11be1b34b273ad · Patch
• https://github.com/siyuan-note/siyuan/issues/16860 · Patch
• https://osv.dev/vulnerability/CVE-2026-23851 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23851 · Security Note
• https://osv.dev/vulnerability/GO-2026-4346 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-94c7-g2fj-7682 · Vendor Advisory
• https://github.com/siyuan-note/siyuan · Note
• https://suse.com/security/cve/CVE-2026-24514 · Note
• https://suse.com/security/cve/CVE-2026-24117 · Note
• https://twitter.com/VulmonFeeds/status/2013411342435131783 · Twitter Post
• https://suse.com/security/cve/CVE-2026-25145 · Note