CVE-2026-25992
High · 7.5CVSS
7.5
EPSS
0.7%
Published
Feb 10, 2026
CISA due date
—
The record
SiYuan is a personal knowledge management system. Prior to 3.5.5, the /api/file/getFile endpoint uses case-sensitive string equality checks to block access to sensitive files. On case-insensitive file systems such as Windows, attackers can bypass restrictions using mixed-case paths and read protected configuration files. This vulnerability is fixed in 3.5.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/siyuan-note/siyuan/kernel | 0 | No fix |
Related vulnerabilities
- GO-2026-4386 SiYuan File Read API Case Sensitivity Bypass can Lead to Path Traversal in… Same vulnerability
- CVE-2026-25539 SiYuan is a personal knowledge management system. Also affects github.com/siyuan-note/siyuan/kernel
- GO-2026-4324 SiYuan Has a Stored Cross-Site Scripting (XSS) Vulnerability via Unrestricted SVG File… Also affects github.com/siyuan-note/siyuan/kernel
- GO-2026-4343 SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon in… Also affects github.com/siyuan-note/siyuan/kernel
- GO-2026-4346 SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality in… Also affects github.com/siyuan-note/siyuan/kernel
- GO-2026-4347 SiYuan vulnerable to Arbitrary file Read / SSRF in github.com/siyuan-note/siyuan/kernel Also affects github.com/siyuan-note/siyuan/kernel
- GO-2026-4387 SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE in… Also affects github.com/siyuan-note/siyuan/kernel
- CVE-2026-23847 SiYuan has a Reflected Cross-Site Scripting (XSS) via /api/icon/getDynamicIcon Also affects github.com/siyuan-note/siyuan/kernel