CVE-2026-25539

SiYuan has Arbitrary File Write via /api/file/copyFile leading to RCE

SiYuan is a personal knowledge management system. Prior to version 3.5.5, the /api/file/copyFile endpoint does not validate the dest parameter, allowing authenticated users to write files to arbitrary locations on the filesystem. This can lead to Remote Code Execution (RCE) by writing to sensitive locations such as cron jobs, SSH authorized_keys, or shell configuration files. This issue has been patched in version 3.5.5.

Affected

siyuan-note · siyuan

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 GITHUB

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

1.13% chance of exploitation in the next 30 days, 66th percentile

Published

2026-02-04

Updated

2026-02-05

Proof-of-concept exploits (1)

• advisories/GHSA-c4jr-5q7w-f6r9

Security advisories

• siyuan-note/siyuan/security/advisories/GHSA-c4jr-5q7w-f6r9
• siyuan-note/siyuan/commit/d7f790755edf8c78d2b4176171e5a0cdcd720feb

References

• CVE Record
• NVD entry