SiYuan hat Arbiträre Datei-Schreibung über /api/file/copyFile, was zu RCE in github.com/siyuan-note/siyuan/kernel führt

The impact of CVE-2026-25539 is severe. Successful exploitation allows an attacker to write arbitrary files to the server's file system. This can be leveraged to overwrite critical system files, inject malicious code (e.g., webshells), or gain persistent access to the system. Depending on the SiYuan application's permissions and deployment environment, this could lead to complete control over the server and any data stored within it. The arbitrary file write capability bypasses typical security controls, making it a particularly dangerous vulnerability. The ability to inject code opens the door to data exfiltration, denial-of-service attacks, and further lateral movement within the network.

Organizations and individuals using SiYuan Kernel in production environments, particularly those with publicly accessible instances or those lacking robust input validation and access controls, are at significant risk. Shared hosting environments where multiple users share the same SiYuan instance are also particularly vulnerable.

• linux / server:

journalctl -u siyuan -g "/api/file/copyFile"

• generic web:

curl -I 'http://<siyuan_server>/api/file/copyFile?path=../../../../etc/passwd' # Check for directory traversal

1. 2026-02-02Disclosure

   disclosure

1. Reserviert2026-02-02
2. Veröffentlicht2026-02-02
3. Geändert2026-03-03
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-25539 is to immediately upgrade SiYuan Kernel to version 3.5.5 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the /api/file/copyFile endpoint using a Web Application Firewall (WAF) or proxy server. Implement strict input validation on the destination file path to prevent attackers from specifying arbitrary locations. Monitor system logs for suspicious file write activity, particularly within sensitive directories. Consider implementing file integrity monitoring (FIM) to detect unauthorized modifications to critical files. After upgrading, verify the fix by attempting to trigger the /api/file/copyFile endpoint with a malicious payload and confirming that the write operation is blocked.