-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a classic two-stage RCE. First, an attacker uses a Zip Slip vulnerability in the unzip function to upload a malicious script to a known location on the server. The unzip function fails to sanitize the file paths within the zip archive, allowing the attacker to write outside of the intended destination directory.
Second, the attacker triggers the execution of the uploaded script by exploiting a command injection vulnerability in the IsValidPandocBin function. This function is called by the setExport API endpoint. The IsValidPandocBin function executes the provided binary path with --version to validate it. By setting the pandocBin path to their uploaded script, the attacker can get it to execute.
The combination of these two vulnerabilities allows a remote, authenticated attacker to achieve remote code execution on the SiYuan server.
kernel.unzipkernel/archive.go
kernel.IsValidPandocBinkernel/setting.go
kernel.setExportkernel/setting.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/siyuan-note/siyuan/kernel | go | <= 0.0.0-20251202123337-6ef83b42c7ce |
A Semantic Attack on Google Gemini - Read the Latest Research