File Manipulation Vulnerability in SiYuan Personal Knowledge Management System
CVE-2026-25539

9.1CRITICAL

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
4 February 2026

What is CVE-2026-25539?

SiYuan, a personal knowledge management system, has a vulnerability in the /api/file/copyFile endpoint prior to version 3.5.5. This flaw permits authenticated users to exploit the dest parameter without adequate validation, allowing them to write files to arbitrary locations on the server's filesystem. This can lead to severe security risks, such as remote code execution, where an attacker could potentially write to sensitive areas like cron jobs, SSH authorized_keys, or shell configuration files, posing a significant threat to the integrity and security of the system. The issue was addressed in version 3.5.5.

Affected Version(s)

siyuan < 3.5.5

References

https://github.com/siyuan-note/siyuan/security/advisories...
x_refsource_CONFIRM
https://github.com/siyuan-note/siyuan/commit/d7f790755edf...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.