Go modules package
github.com/siyuan-note/siyuan/kernel
pkg:golang/github.com/siyuan-note/siyuan/kernel
Vulnerabilities (53)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-29073 | Hig | 8.8 | <= 0.0.0-20260113130602-4ba64580c29c | — | Mar 6, 2026 | SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directly, but it only checks basic auth, not admin rights, any logged-in user, even readers, can run any sql query on the database. This issue has been patched in vers | |
| CVE-2026-25992 | Hig | 7.5 | <= 0.0.0-20260126094835-d5d10dd41b0c | — | Feb 10, 2026 | SiYuan is a personal knowledge management system. Prior to 3.5.5, the /api/file/getFile endpoint uses case-sensitive string equality checks to block access to sensitive files. On case-insensitive file systems such as Windows, attackers can bypass restrictions using mixed-case pat | |
| CVE-2026-25539 | Cri | 9.1 | <= 0.0.0-20260126094835-d5d10dd41b0c | — | Feb 4, 2026 | SiYuan is a personal knowledge management system. Prior to version 3.5.5, the /api/file/copyFile endpoint does not validate the dest parameter, allowing authenticated users to write files to arbitrary locations on the filesystem. This can lead to Remote Code Execution (RCE) by wr | |
| CVE-2026-23851 | Med | 6.5 | < 0.0.0-20260118092521-f8f4b517077b | 0.0.0-20260118092521-f8f4b517077b | Jan 19, 2026 | SiYuan is a personal knowledge management system. Versions prior to 3.5.4 contain a logic vulnerability in the /api/file/globalCopyFiles endpoint. The function allows authenticated users to copy files from any location on the server's filesystem into the application's workspace w | |
| CVE-2026-23850 | Hig | 7.5 | < 0.0.0-20260118092326-b2274baba2e1 | 0.0.0-20260118092326-b2274baba2e1 | Jan 19, 2026 | SiYuan is a personal knowledge management system. In versions prior to 3.5.4, the markdown feature allows unrestricted server side html-rendering which allows arbitrary file read (LFD). Version 3.5.4 fixes the issue. | |
| CVE-2026-23847 | Med | 6.1 | < 0.0.0-20260118021606-5c0cc375b475 | 0.0.0-20260118021606-5c0cc375b475 | Jan 19, 2026 | SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to unsanitized SVG input. The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted | |
| CVE-2026-23645 | Med | 6.1 | < 0.0.0-20260116101155-11115da3d0de | 0.0.0-20260116101155-11115da3d0de | Jan 16, 2026 | SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malicious SVG file (e.g., i | |
| CVE-2025-67488 | Hig | 7.8 | <= 0.0.0-20251202123337-6ef83b42c7ce | — | Dec 9, 2025 | SiYuan is self-hosted, open source personal knowledge management software. Versions 0.0.0-20251202123337-6ef83b42c7ce and below contain function importZipMd which is vulnerable to ZipSlips, allowing an authenticated user to overwrite files on the system. An authenticated user wit | |
| CVE-2025-21609 | Cri | 9.1 | >= 0 | — | Jan 3, 2025 | SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the `POST /api/history/getDocHistoryContent` endpoint. An attacker can craft a payload to exploit this v | |
| CVE-2024-55660 | Cri | 9.8 | <= 0.0.0-20241210012039-5129ad926a21 | — | Dec 12, 2024 | SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's `/api/template/renderSprig` endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows attackers to access en | |
| CVE-2024-55659 | Med | 5.4 | <= 0.0.0-20241210012039-5129ad926a21 | — | Dec 12, 2024 | SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting (via the file write). Version 3.1.16 contains a patch for the issue. | |
| CVE-2024-55658 | Hig | 7.5 | <= 0.0.0-20241210012039-5129ad926a21 | — | Dec 12, 2024 | SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host s | |
| CVE-2024-55657 | Hig | 7.5 | <= 0.0.0-20241210012039-5129ad926a21 | — | Dec 12, 2024 | SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's `/api/template/render` endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system |
- affected <= 0.0.0-20260113130602-4ba64580c29c
SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directly, but it only checks basic auth, not admin rights, any logged-in user, even readers, can run any sql query on the database. This issue has been patched in vers
- affected <= 0.0.0-20260126094835-d5d10dd41b0c
SiYuan is a personal knowledge management system. Prior to 3.5.5, the /api/file/getFile endpoint uses case-sensitive string equality checks to block access to sensitive files. On case-insensitive file systems such as Windows, attackers can bypass restrictions using mixed-case pat
- affected <= 0.0.0-20260126094835-d5d10dd41b0c
SiYuan is a personal knowledge management system. Prior to version 3.5.5, the /api/file/copyFile endpoint does not validate the dest parameter, allowing authenticated users to write files to arbitrary locations on the filesystem. This can lead to Remote Code Execution (RCE) by wr
- affected < 0.0.0-20260118092521-f8f4b517077bfixed 0.0.0-20260118092521-f8f4b517077b
SiYuan is a personal knowledge management system. Versions prior to 3.5.4 contain a logic vulnerability in the /api/file/globalCopyFiles endpoint. The function allows authenticated users to copy files from any location on the server's filesystem into the application's workspace w
- affected < 0.0.0-20260118092326-b2274baba2e1fixed 0.0.0-20260118092326-b2274baba2e1
SiYuan is a personal knowledge management system. In versions prior to 3.5.4, the markdown feature allows unrestricted server side html-rendering which allows arbitrary file read (LFD). Version 3.5.4 fixes the issue.
- affected < 0.0.0-20260118021606-5c0cc375b475fixed 0.0.0-20260118021606-5c0cc375b475
SiYuan is a personal knowledge management system. Versions prior to 3.5.4 are vulnerable to reflected cross-site scripting in /api/icon/getDynamicIcon due to unsanitized SVG input. The endpoint generates SVG images for text icons (type=8). The content query parameter is inserted
- affected < 0.0.0-20260116101155-11115da3d0defixed 0.0.0-20260116101155-11115da3d0de
SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting (XSS) vulnerability exists in SiYuan Note. The application does not sanitize uploaded SVG files. If a user uploads and views a malicious SVG file (e.g., i
- affected <= 0.0.0-20251202123337-6ef83b42c7ce
SiYuan is self-hosted, open source personal knowledge management software. Versions 0.0.0-20251202123337-6ef83b42c7ce and below contain function importZipMd which is vulnerable to ZipSlips, allowing an authenticated user to overwrite files on the system. An authenticated user wit
- affected >= 0
SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the `POST /api/history/getDocHistoryContent` endpoint. An attacker can craft a payload to exploit this v
- affected <= 0.0.0-20241210012039-5129ad926a21
SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's `/api/template/renderSprig` endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows attackers to access en
- affected <= 0.0.0-20241210012039-5129ad926a21
SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting (via the file write). Version 3.1.16 contains a patch for the issue.
- affected <= 0.0.0-20241210012039-5129ad926a21
SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host s
- affected <= 0.0.0-20241210012039-5129ad926a21
SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's `/api/template/render` endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system
Page 3 of 3