Plattform
go
Komponente
github.com/siyuan-note/siyuan/kernel
Behoben in
3.5.6
0.0.1
CVE-2026-25992 describes a Path Traversal vulnerability discovered in the SiYuan Kernel, the core component of the SiYuan note-taking application. This flaw allows attackers to bypass case sensitivity checks in the File Read API, potentially leading to unauthorized access to sensitive files on the server. The vulnerability impacts versions of SiYuan Kernel prior to 3.5.5, and a patch has been released to address the issue.
Successful exploitation of CVE-2026-25992 allows an attacker to read arbitrary files from the server's file system. This could include configuration files containing sensitive information like database credentials, API keys, or internal system details. Depending on the server's configuration and the files accessible, an attacker could gain a deeper understanding of the system's architecture, potentially leading to further exploitation attempts. The blast radius extends to any data accessible through the vulnerable file read endpoint, making it a significant security concern.
CVE-2026-25992 was publicly disclosed on 2026-02-02. Currently, there are no known public exploits or active campaigns targeting this vulnerability. The KEV status is pending evaluation. Monitor security advisories and threat intelligence feeds for any updates regarding exploitation attempts.
SiYuan users running versions prior to 3.5.5 are at risk. This includes individuals and organizations using SiYuan for personal note-taking, team collaboration, or knowledge management. Shared hosting environments where SiYuan is installed are particularly vulnerable, as a compromise of one user's instance could potentially impact others.
• go / server:
find / -name "siyuan/kernel" -type d -print• go / server:
ps aux | grep siyuan• generic web:
Inspect access logs for requests containing unusual path traversal sequences (e.g., ../../../../etc/passwd).
• generic web:
Monitor response headers for unexpected file content types.
disclosure
Exploit-Status
EPSS
0.06% (19% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2026-25992 is to upgrade SiYuan Kernel to version 3.5.5 or later. This patched version includes fixes to properly handle case sensitivity in the File Read API, preventing the path traversal bypass. If immediate upgrading is not possible, consider implementing strict input validation on the File Read API endpoint to sanitize user-provided file paths. While not a complete solution, this can reduce the attack surface. Regularly review file permissions to ensure that only authorized users have access to sensitive files.
Actualice SiYuan a la versión 3.5.5 o posterior. Esta versión corrige la vulnerabilidad de omisión de la validación de acceso a archivos sensibles debido a la distinción entre mayúsculas y minúsculas en los sistemas de archivos.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2026-25992 is a Path Traversal vulnerability in SiYuan Kernel, allowing attackers to read arbitrary files due to a case sensitivity bypass in the File Read API.
You are affected if you are using SiYuan Kernel versions prior to 3.5.5. Upgrade to the latest version to mitigate the risk.
Upgrade SiYuan Kernel to version 3.5.5 or later. If immediate upgrade is not possible, implement stricter file access controls.
As of the public disclosure date, there are no known public exploits or active campaigns targeting this vulnerability, but monitoring is advised.
Refer to the official SiYuan project website and GitHub repository for security advisories and updates related to CVE-2026-25992.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Lade deine go.mod-Datei hoch und wir sagen dir sofort, ob du betroffen bist.