CVE-2026-23851
published 2026-01-19CVE-2026-23851: SiYuan is a personal knowledge management system. Versions prior to 3.5.4 contain a logic vulnerability in the /api/file/globalCopyFiles endpoint. The function…
PriorityP343medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.44%
34.8th percentile
SiYuan is a personal knowledge management system. Versions prior to 3.5.4 contain a logic vulnerability in the /api/file/globalCopyFiles endpoint. The function allows authenticated users to copy files from any location on the server's filesystem into the application's workspace without proper path validation. The vulnerability exists in the api/file.go source code. The function globalCopyFiles accepts a list of source paths (srcs) from the JSON request body. While the code checks if the source file exists using filelock.IsExist(src), it fails to validate whether the source path resides within the authorized workspace directory. Version 3.5.4 patches the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| b3log | siyuan | < 3.5.4 | 3.5.4 |
| github.com | siyuan-note_siyuan_kernel | >= 0 < 0.0.0-20260118092521-f8f4b517077b | 0.0.0-20260118092521-f8f4b517077b |
| siyuan-note | siyuan | < 3.5.4 | 3.5.4 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv4.08.3HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality in github.com/siyuan-note/siyuan/kernel
osv·2026-02-03
CVE-2026-23851 SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality in github.com/siyuan-note/siyuan/kernel
SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality in github.com/siyuan-note/siyuan/kernel
SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality in github.com/siyuan-note/siyuan/kernel
GHSA
SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality
ghsa·2026-01-21
CVE-2026-23851 [HIGH] CWE-22 SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality
SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality
### Summary
The SiYuan Note application (v3.5.3) contains a logic vulnerability in the /api/file/globalCopyFiles endpoint. The function allows authenticated users to copy files from any location on the server's filesystem into the application's workspace without proper path validation
### Details
The vulnerability exists in the api/file.go source code. The function globalCopyFiles accepts a list of source paths (srcs) from the JSON request body. While the code checks if the source file exists using filelock.IsExist(src), it fails to validate whether the source path resides within the authorized workspace directory.
```
func globalCopyFiles(c *gin.Context) {
// ...
srcsArg := arg["srcs"].([]interface{})
for _, src :=
OSV
SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality
osv·2026-01-21
CVE-2026-23851 [HIGH] SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality
SiYuan Vulnerable to Arbitrary File Read via File Copy Functionality
### Summary
The SiYuan Note application (v3.5.3) contains a logic vulnerability in the /api/file/globalCopyFiles endpoint. The function allows authenticated users to copy files from any location on the server's filesystem into the application's workspace without proper path validation
### Details
The vulnerability exists in the api/file.go source code. The function globalCopyFiles accepts a list of source paths (srcs) from the JSON request body. While the code checks if the source file exists using filelock.IsExist(src), it fails to validate whether the source path resides within the authorized workspace directory.
```
func globalCopyFiles(c *gin.Context) {
// ...
srcsArg := arg["srcs"].([]interface{})
for _, src :=
No detection rules found.
No public exploits indexed.
2026-01-19
Published