SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE in github.com/siyuan-note/siyuan/kernel

The core of this vulnerability lies in a ZipSlip issue, a common problem where ZIP archive extraction doesn't properly sanitize file paths. An attacker can craft a malicious ZIP file with carefully constructed directory structures that, when extracted by SiYuan, will overwrite arbitrary files on the system. This file overwrite capability can be leveraged to overwrite critical system binaries, configuration files, or even inject malicious code into existing processes. Successful exploitation could grant an attacker full control over the affected SiYuan instance, potentially leading to data theft, system disruption, or further lateral movement within the network. The impact is particularly severe given SiYuan's potential use for sensitive note-taking and knowledge management.

Organizations and individuals using SiYuan for note-taking, knowledge management, or any application where sensitive data is stored are at risk. This includes users who rely on SiYuan for collaborative work or data sharing, as a compromised instance could expose sensitive information to unauthorized parties. Users with older, unpatched SiYuan installations are particularly vulnerable.

• linux / server:

find /opt/siyuan/ -type f -name '*.zip' -print0 | xargs -0 grep -i '\\..' # Check for double backslashes in ZIP files

• go / supply-chain: Inspect SiYuan's Go dependencies for known vulnerabilities using go mod tidy and go vet. • generic web: Monitor web server access logs for requests containing ZIP files with unusual or deeply nested directory structures. • linux / server:

journalctl -u siyuan -g "zip extraction" # Look for errors related to zip extraction

1. 2025-12-15Disclosure

   disclosure

2. 2025-12-15Patch

   patch

1. Reserviert2025-12-08
2. Veröffentlicht2025-12-15
3. Geändert2026-03-03
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-67488 is to immediately upgrade SiYuan to version 3.5.0 or later, which includes the necessary fix. If upgrading is not immediately feasible due to compatibility concerns or system downtime requirements, consider implementing stricter input validation on ZIP files processed by SiYuan. Specifically, sanitize file paths extracted from ZIP archives to prevent traversal attacks. While not a complete solution, this can reduce the attack surface. Monitor system logs for unusual file modification activity, particularly in sensitive directories. Consider implementing a Web Application Firewall (WAF) with rules to block uploads of malicious ZIP files containing suspicious path patterns. After upgrading, confirm the fix by attempting to upload a test ZIP file containing a known malicious path pattern and verifying that the file is not overwritten.