CVE-2025-67488: RCE in SiYuan Kernel

The core of this vulnerability lies in a ZipSlip issue, a common problem where ZIP archive extraction doesn't properly sanitize file paths. An attacker can craft a malicious ZIP file with carefully constructed directory structures that, when extracted by SiYuan, will overwrite arbitrary files on the system. This file overwrite capability can be leveraged to overwrite critical system binaries, configuration files, or even inject malicious code into existing processes. Successful exploitation could grant an attacker full control over the affected SiYuan instance, potentially leading to data theft, system disruption, or further lateral movement within the network. The impact is particularly severe given SiYuan's potential use for sensitive note-taking and knowledge management.

1. Reserved2025-12-08
2. Published2025-12-15
3. Modified2026-03-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-67488 is to immediately upgrade SiYuan to version 3.5.0 or later, which includes the necessary fix. If upgrading is not immediately feasible due to compatibility concerns or system downtime requirements, consider implementing stricter input validation on ZIP files processed by SiYuan. Specifically, sanitize file paths extracted from ZIP archives to prevent traversal attacks. While not a complete solution, this can reduce the attack surface. Monitor system logs for unusual file modification activity, particularly in sensitive directories. Consider implementing a Web Application Firewall (WAF) with rules to block uploads of malicious ZIP files containing suspicious path patterns. After upgrading, confirm the fix by attempting to upload a test ZIP file containing a known malicious path pattern and verifying that the file is not overwritten.