CVE-2026-23851
Description
SiYuan is a personal knowledge management system. Versions prior to 3.5.4 contain a logic vulnerability in the /api/file/globalCopyFiles endpoint. The function allows authenticated users to copy files from any location on the server's filesystem into the application's workspace without proper path validation. The vulnerability exists in the api/file.go source code. The function globalCopyFiles accepts a list of source paths (srcs) from the JSON request body. While the code checks if the source file exists using filelock.IsExist(src), it fails to validate whether the source path resides within the authorized workspace directory. Version 3.5.4 patches the issue.
How to fix
- b3log siyuan3.5.4 or later
- github.com/siyuan-note/siyuan/kernel0.0.0-20260118092521-f8f4b517077b or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| b3log siyuan | v < 3.5.4 | 3.5.4 |
| github.com/siyuan-note/siyuan/kernelGo | v < 0.0.0-20260118092521-f8f4b517077b | 0.0.0-20260118092521-f8f4b517077b |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.