Logic Vulnerability in SiYuan Personal Knowledge Management System
CVE-2026-23851

8.3HIGH

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
19 January 2026

What is CVE-2026-23851?

The SiYuan personal knowledge management system features a logic vulnerability in the /api/file/globalCopyFiles endpoint. This flaw permits authenticated users to copy files from any location on the server into the application’s workspace without adequate path validation. While the system checks for the existence of the source file via filelock.IsExist(src), it neglects to ensure that the file path is within the permitted workspace directory. This oversight potentially allows malicious users to access sensitive data. The vulnerability was patched in version 3.5.4, enhancing the application's security.

Affected Version(s)

siyuan < 3.5.4

References

https://github.com/siyuan-note/siyuan/security/advisories...
x_refsource_CONFIRM
https://github.com/siyuan-note/siyuan/issues/16860
x_refsource_MISC
https://github.com/siyuan-note/siyuan/commit/b2274baba2e1...
x_refsource_MISC

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.