CVE-2026-23850

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23850
SiYuan is a personal knowledge management system. In versions prior to 3.5.4, the markdown feature allows unrestricted server side html-rendering which allows arbitrary file read (LFD). Version 3.5.4 fixes the issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/siyuan-note/siyuan/blob/master/kernel/model/file.go#L1035 Product
https://github.com/siyuan-note/siyuan/blob/v3.4.2/kernel/api/filetree.go#L799-L886 Product
https://github.com/siyuan-note/siyuan/commit/b2274baba2e11c8cf8901b0c5c871e5b27f1f6dd Patch
https://github.com/siyuan-note/siyuan/commit/f8f4b517077b92c90c0d7b51ac11be1b34b273ad Patch
https://github.com/siyuan-note/siyuan/issues/16860 Issue Tracking Patch
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-cv54-7wv7-qxcw Exploit Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*
History

29 Apr 2026, 01:00

Type Values Removed Values Added
Summary
  • (es) SiYuan es un sistema de gestión de conocimiento personal. En versiones anteriores a la 3.5.4, la característica de markdown permite la renderización HTML sin restricciones del lado del servidor, lo que permite la lectura arbitraria de archivos (LFD). La versión 3.5.4 corrige el problema.

30 Jan 2026, 15:35

Type Values Removed Values Added
References () https://github.com/siyuan-note/siyuan/blob/master/kernel/model/file.go#L1035 - () https://github.com/siyuan-note/siyuan/blob/master/kernel/model/file.go#L1035 - Product
References () https://github.com/siyuan-note/siyuan/blob/v3.4.2/kernel/api/filetree.go#L799-L886 - () https://github.com/siyuan-note/siyuan/blob/v3.4.2/kernel/api/filetree.go#L799-L886 - Product
References () https://github.com/siyuan-note/siyuan/commit/b2274baba2e11c8cf8901b0c5c871e5b27f1f6dd - () https://github.com/siyuan-note/siyuan/commit/b2274baba2e11c8cf8901b0c5c871e5b27f1f6dd - Patch
References () https://github.com/siyuan-note/siyuan/commit/f8f4b517077b92c90c0d7b51ac11be1b34b273ad - () https://github.com/siyuan-note/siyuan/commit/f8f4b517077b92c90c0d7b51ac11be1b34b273ad - Patch
References () https://github.com/siyuan-note/siyuan/issues/16860 - () https://github.com/siyuan-note/siyuan/issues/16860 - Issue Tracking, Patch
References () https://github.com/siyuan-note/siyuan/security/advisories/GHSA-cv54-7wv7-qxcw - () https://github.com/siyuan-note/siyuan/security/advisories/GHSA-cv54-7wv7-qxcw - Exploit, Patch, Vendor Advisory
First Time B3log
B3log siyuan
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CPE cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*

19 Jan 2026, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-19 20:15

Updated : 2026-04-29 01:00

NVD link : CVE-2026-23850

Mitre link : CVE-2026-23850

CVE.ORG link : CVE-2026-23850

JSON object : View

Products Affected

b3log

  • siyuan
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')