CVE-2026-23851
📋 TL;DR
This CVE describes a path traversal vulnerability in SiYuan's file copy endpoint that allows authenticated users to copy arbitrary files from the server's filesystem into the application workspace. The vulnerability affects SiYuan versions before 3.5.4 and requires user authentication to exploit.
💻 Affected Systems
- SiYuan personal knowledge management system
📦 What is this software?
Siyuan by B3log
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could exfiltrate sensitive system files, configuration files, or other application data by copying them to the workspace where they can be accessed through the application interface.
Likely Case
Authenticated users could access files outside their authorized workspace boundaries, potentially exposing other users' data or system configuration files.
If Mitigated
With proper authentication controls and network segmentation, the impact is limited to authorized users accessing files they shouldn't be able to reach within the application context.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of the API endpoint
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.4
Vendor Advisory: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-94c7-g2fj-7682
Restart Required: Yes
Instructions:
1. Backup your SiYuan data. 2. Stop the SiYuan service. 3. Update to version 3.5.4 or later. 4. Restart the service. 5. Verify the update was successful.
🔧 Temporary Workarounds
Restrict API endpoint access
allUse web application firewall or reverse proxy rules to restrict access to the vulnerable /api/file/globalCopyFiles endpoint
# Example nginx location block to block the endpoint
location /api/file/globalCopyFiles { return 403; }
Implement file system restrictions
linuxRun SiYuan in a container or chroot environment with restricted filesystem access
# Example Docker run command with volume restrictions
docker run -v /path/to/workspace:/app/workspace:ro siyuan-note/siyuan
🧯 If You Can't Patch
- Implement strict access controls and monitor authenticated user activity
- Deploy network segmentation to isolate SiYuan from sensitive systems and files
🔍 How to Verify
Check if Vulnerable:
Check SiYuan version via web interface or by examining the application files. Versions below 3.5.4 are vulnerable.Check Version:
Check the SiYuan web interface settings or examine the application directory for version informationVerify Fix Applied:
After updating, verify the version is 3.5.4 or higher and test that the /api/file/globalCopyFiles endpoint properly validates source paths.📡 Detection & Monitoring
Log Indicators:
- Unusual file copy operations via API
- Requests to /api/file/globalCopyFiles with suspicious source paths
- Multiple failed path validation attempts
Network Indicators:
- POST requests to /api/file/globalCopyFiles with JSON payload containing absolute paths or path traversal sequences
SIEM Query:
source="siyuan.log" AND (uri_path="/api/file/globalCopyFiles" AND (src CONTAINS ".." OR src CONTAINS "/"))🔗 References
- https://github.com/siyuan-note/siyuan/commit/b2274baba2e11c8cf8901b0c5c871e5b27f1f6dd
- https://github.com/siyuan-note/siyuan/commit/f8f4b517077b92c90c0d7b51ac11be1b34b273ad
- https://github.com/siyuan-note/siyuan/issues/16860
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-94c7-g2fj-7682
