CVE-2026-23850
📋 TL;DR
SiYuan personal knowledge management system versions before 3.5.4 contain a path traversal vulnerability in the markdown feature's HTML rendering. This allows attackers to read arbitrary files on the server. All users running vulnerable versions are affected.
💻 Affected Systems
- SiYuan Personal Knowledge Management System
📦 What is this software?
Siyuan by B3log
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through sensitive file disclosure (configuration files, credentials, database contents), potentially leading to lateral movement and data exfiltration.
Likely Case
Unauthorized reading of sensitive files containing credentials, configuration data, or user information stored on the server.
If Mitigated
Limited impact with proper network segmentation and file system permissions restricting access to sensitive directories.
🎯 Exploit Status
The vulnerability appears to be exploitable without authentication based on the CWE-22 (Path Traversal) classification and unrestricted server-side HTML rendering.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.4
Vendor Advisory: https://github.com/siyuan-note/siyuan/commit/b2274baba2e11c8cf8901b0c5c871e5b27f1f6dd
Restart Required: Yes
Instructions:
1. Backup your SiYuan data. 2. Download version 3.5.4 or later from the official repository. 3. Stop the SiYuan service. 4. Replace the installation with the new version. 5. Restart the SiYuan service.
🔧 Temporary Workarounds
Disable Markdown Feature
allTemporarily disable the markdown rendering functionality to prevent exploitation.
Modify configuration to disable markdown processing (specific commands depend on deployment)
File System Restrictions
linuxImplement strict file system permissions to limit SiYuan's access to sensitive directories.
chmod 750 /path/to/siyuan/data
chown siyuan:siyuan /path/to/siyuan/data
🧯 If You Can't Patch
- Implement strict network access controls to limit SiYuan exposure to trusted networks only.
- Deploy a web application firewall (WAF) with path traversal protection rules enabled.
🔍 How to Verify
Check if Vulnerable:
Check if SiYuan version is below 3.5.4 in the application settings or about page.Check Version:
Check application UI or configuration files for version information.Verify Fix Applied:
Confirm version is 3.5.4 or higher and test that path traversal attempts in markdown input are properly blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in application logs
- Multiple failed path traversal attempts
- Access to sensitive file paths
Network Indicators:
- HTTP requests containing '../' sequences in markdown-related endpoints
- Unusual file download patterns
SIEM Query:
source="siyuan" AND (url="*../*" OR message="*path traversal*" OR message="*file read*")🔗 References
- https://github.com/siyuan-note/siyuan/blob/master/kernel/model/file.go#L1035
- https://github.com/siyuan-note/siyuan/blob/v3.4.2/kernel/api/filetree.go#L799-L886
- https://github.com/siyuan-note/siyuan/commit/b2274baba2e11c8cf8901b0c5c871e5b27f1f6dd
- https://github.com/siyuan-note/siyuan/commit/f8f4b517077b92c90c0d7b51ac11be1b34b273ad
- https://github.com/siyuan-note/siyuan/issues/16860
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-cv54-7wv7-qxcw
