CVE-2026-25539
Critical · 9.1CVSS
9.1
EPSS
1.1%
Published
Feb 4, 2026
CISA due date
—
The record
SiYuan is a personal knowledge management system. Prior to version 3.5.5, the /api/file/copyFile endpoint does not validate the dest parameter, allowing authenticated users to write files to arbitrary locations on the filesystem. This can lead to Remote Code Execution (RCE) by writing to sensitive locations such as cron jobs, SSH authorized_keys, or shell configuration files. This issue has been patched in version 3.5.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/siyuan-note/siyuan/kernel | 0 | No fix |
Related vulnerabilities
- GO-2026-4387 SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE in… Same vulnerability
- CVE-2026-25992 SiYuan is a personal knowledge management system. Also affects github.com/siyuan-note/siyuan/kernel
- GO-2026-4324 SiYuan Has a Stored Cross-Site Scripting (XSS) Vulnerability via Unrestricted SVG File… Also affects github.com/siyuan-note/siyuan/kernel
- GO-2026-4343 SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon in… Also affects github.com/siyuan-note/siyuan/kernel
- GO-2026-4346 SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality in… Also affects github.com/siyuan-note/siyuan/kernel
- GO-2026-4347 SiYuan vulnerable to Arbitrary file Read / SSRF in github.com/siyuan-note/siyuan/kernel Also affects github.com/siyuan-note/siyuan/kernel
- GO-2026-4386 SiYuan File Read API Case Sensitivity Bypass can Lead to Path Traversal in… Also affects github.com/siyuan-note/siyuan/kernel
- CVE-2026-23847 SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon Also affects github.com/siyuan-note/siyuan/kernel