CVE-2026-23851

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23851
SiYuan is a personal knowledge management system. Versions prior to 3.5.4 contain a logic vulnerability in the /api/file/globalCopyFiles endpoint. The function allows authenticated users to copy files from any location on the server's filesystem into the application's workspace without proper path validation. The vulnerability exists in the api/file.go source code. The function globalCopyFiles accepts a list of source paths (srcs) from the JSON request body. While the code checks if the source file exists using filelock.IsExist(src), it fails to validate whether the source path resides within the authorized workspace directory. Version 3.5.4 patches the issue.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/siyuan-note/siyuan/commit/b2274baba2e11c8cf8901b0c5c871e5b27f1f6dd Patch
https://github.com/siyuan-note/siyuan/commit/f8f4b517077b92c90c0d7b51ac11be1b34b273ad Patch
https://github.com/siyuan-note/siyuan/issues/16860 Issue Tracking Patch
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-94c7-g2fj-7682 Exploit Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*
History

17 Jun 2026, 10:22

Type Values Removed Values Added
Summary
  • (es) SiYuan es un sistema de gestión de conocimiento personal. Las versiones anteriores a la 3.5.4 contienen una vulnerabilidad de lógica en el endpoint /api/file/globalCopyFiles. La función permite a los usuarios autenticados copiar archivos desde cualquier ubicación del sistema de archivos del servidor al espacio de trabajo de la aplicación sin una validación de ruta adecuada. La vulnerabilidad existe en el código fuente api/file.go. La función globalCopyFiles acepta una lista de rutas de origen (srcs) del cuerpo de la solicitud JSON. Aunque el código verifica si el archivo de origen existe usando filelock.IsExist(src), no valida si la ruta de origen reside dentro del directorio de espacio de trabajo autorizado. La versión 3.5.4 corrige el problema.
References () https://github.com/siyuan-note/siyuan/security/advisories/GHSA-94c7-g2fj-7682 - Vendor Advisory, Exploit, Patch () https://github.com/siyuan-note/siyuan/security/advisories/GHSA-94c7-g2fj-7682 - Exploit, Patch, Vendor Advisory

30 Jan 2026, 15:12

Type Values Removed Values Added
References () https://github.com/siyuan-note/siyuan/commit/b2274baba2e11c8cf8901b0c5c871e5b27f1f6dd - () https://github.com/siyuan-note/siyuan/commit/b2274baba2e11c8cf8901b0c5c871e5b27f1f6dd - Patch
References () https://github.com/siyuan-note/siyuan/commit/f8f4b517077b92c90c0d7b51ac11be1b34b273ad - () https://github.com/siyuan-note/siyuan/commit/f8f4b517077b92c90c0d7b51ac11be1b34b273ad - Patch
References () https://github.com/siyuan-note/siyuan/issues/16860 - () https://github.com/siyuan-note/siyuan/issues/16860 - Issue Tracking, Patch
References () https://github.com/siyuan-note/siyuan/security/advisories/GHSA-94c7-g2fj-7682 - () https://github.com/siyuan-note/siyuan/security/advisories/GHSA-94c7-g2fj-7682 - Vendor Advisory, Exploit, Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CPE cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*
First Time B3log
B3log siyuan

19 Jan 2026, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-19 20:15

Updated : 2026-06-17 10:22

NVD link : CVE-2026-23851

Mitre link : CVE-2026-23851

CVE.ORG link : CVE-2026-23851

JSON object : View

Products Affected

b3log

  • siyuan
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')