Vulnerability · Published Feb 4, 2026 · Assigned by GitHub_M
CVE-2026-25539SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE
Critical 9.1
In plain English
A critical-severity path traversal in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Official description
SiYuan is a personal knowledge management system. Prior to version 3.5.5, the /api/file/copyFile endpoint does not validate the dest parameter, allowing authenticated users to write files to arbitrary locations on the filesystem. This can lead to Remote Code Execution (RCE) by writing to sensitive locations such as cron jobs, SSH authorized_keys, or shell configuration files. This issue has been patched in version 3.5.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/siyuan-note/siyuan/kernel | no fix listed | GO-2026-4387 |
| Go | github.com/siyuan-note/siyuan/kernel | no fix listed | GHSA-c4jr-5q7w-f6r9 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| siyuan-note | siyuan | < 3.5.5 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H