by Kastro
Paper/Archive/CVE-2026-25539

CVE-2026-25539

siyuan-note siyuan — SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE

EPSS 1%public exploitCVSS 9.1
critical.is priorityof 100
51
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 65.8.658 × 2013.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

SiYuan is a personal knowledge management system. Prior to version 3.5.5, the /api/file/copyFile endpoint does not validate the dest parameter, allowing authenticated users to write files to arbitrary locations on the filesystem. This can lead to Remote Code Execution (RCE) by writing to sensitive locations such as cron jobs, SSH authorized_keys, or shell configuration files. This issue has been patched in version 3.5.5.

Affected

ProductAffectedFixed inSource
siyuan< 3.5.5–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/siyuan-note/siyuan/security/advisories/GHSA-c4jr-5q7w-f6r9refgithub.com/siyuan-note/siyuan/commit/d7f790755edf8c78d2b4176171e5a0cdcd720feb