CVE-2026-23850

7.5 HIGH
Published: January 19, 2026 Modified: January 30, 2026
View on NVD

Description

SiYuan is a personal knowledge management system. In versions prior to 3.5.4, the markdown feature allows unrestricted server side html-rendering which allows arbitrary file read (LFD). Version 3.5.4 fixes the issue.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/siyuan-note/siyuan/blob/master/kernel/model/file.go#L1035
Source: security-advisories@github.com
Product
https://github.com/siyuan-note/siyuan/blob/v3.4.2/kernel/api/filetree.go#L799-L886
Source: security-advisories@github.com
Product
https://github.com/siyuan-note/siyuan/commit/b2274baba2e11c8cf8901b0c5c871e5b27f1f6dd
Source: security-advisories@github.com
Patch
https://github.com/siyuan-note/siyuan/commit/f8f4b517077b92c90c0d7b51ac11be1b34b273ad
Source: security-advisories@github.com
Patch
https://github.com/siyuan-note/siyuan/issues/16860
Source: security-advisories@github.com
Issue Tracking Patch
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-cv54-7wv7-qxcw
Source: security-advisories@github.com
Exploit Patch Vendor Advisory

6 reference(s) from NVD

Quick Stats

CVSS v3 Score
7.5 / 10.0
EPSS (Exploit Probability)
0.1%
25th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-22

Affected Vendors

b3log

Related CVEs

CVE-2026-4572 6.3
CVE-2026-4571 6.3
CVE-2026-4570 6.3
CVE-2025-10736 6.5
CVE-2026-4569 6.3