CVE-2026-23850: SiYuan vulnerable to Arbitrary file Read / SSRF
Markdown feature allows unrestricted server side html-rendering which allows arbitary file read (LFD) and fully SSRF access We in @0xL4ugh ( @abdoghazy2015, @xtromera, @A-z4ki, @ZeyadZonkorany and @KarimTantawey) During playing Null CTF 2025 that helps us solved a challenge with unintended way : )
Please note that we used the latest Version and deployed it via this dockerfile :
Dockerfile:
FROM b3log/siyuan
ENV TZ=America/New_York \
PUID=1000 \
PGID=1000 \
SIYUAN_ACCESS_AUTH_CODE=SuperSecretPassword
RUN mkdir -p /siyuan/workspace
COPY ./startup.sh /opt/siyuan/startup.sh
RUN chmod +x /opt/siyuan/startup.sh
EXPOSE 6806
ENTRYPOINT ["sh", "-c", "/opt/siyuan/startup.sh"]
startup.sh
References
- github.com/advisories/GHSA-cv54-7wv7-qxcw
- github.com/siyuan-note/siyuan
- github.com/siyuan-note/siyuan/blob/master/kernel/model/file.go
- github.com/siyuan-note/siyuan/blob/v3.4.2/kernel/api/filetree.go
- github.com/siyuan-note/siyuan/commit/b2274baba2e11c8cf8901b0c5c871e5b27f1f6dd
- github.com/siyuan-note/siyuan/commit/f8f4b517077b92c90c0d7b51ac11be1b34b273ad
- github.com/siyuan-note/siyuan/issues/16860
- github.com/siyuan-note/siyuan/security/advisories/GHSA-cv54-7wv7-qxcw
- nvd.nist.gov/vuln/detail/CVE-2026-23850
Code Behaviors & Features
Detect and mitigate CVE-2026-23850 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →