N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-4r66-7rcv-x46x

GHSA-4r66-7rcv-x46x: SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin

Summary

Siyuan is vulnerable to RCE. The issue stems from a "Zip Slip" vulnerability during zip file extraction, combined with the ability to overwrite system executables and subsequently trigger their execution.

Steps to reproduce

Authenticate
Create zip slip payload with path traversal entry ../../../../opt/siyuan/startup.sh. startup.sh contains malicious code like:

#!/bin/sh
echo 'you have been pwned' > /siyuan/workspace/data/pwned.txt
echo "pandoc 3.1.0"

Upload zip to workspace via /api/file/putFile
Extract zip via /api/archive/unzip, overwrites the existing executable startup.sh while maintaining the +x permission
Trigger execution by calling /api/setting/setExport with pandocBin=/opt/siyuan/startup.sh. This calls IsValidPandocBin() which executes startup.sh --version that outputs "pandoc 3.1.0" and executes any arbitrary malicious code

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-4r66-7rcv-x46x

GHSA-4r66-7rcv-x46x:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/siyuan-note/siyuan/kernel	go	<= 0.0.0-20251202123337-6ef83b42c7ce

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic two-stage RCE. First, an attacker uses a Zip Slip vulnerability in the unzip function to upload a malicious script to a known location on the server. The unzip function fails to sanitize the file paths within the zip archive, allowing the attacker to write outside of the intended destination directory.

Second, the attacker triggers the execution of the uploaded script by exploiting a command injection vulnerability in the IsValidPandocBin function. This function is called by the setExport API endpoint. The IsValidPandocBin function executes the provided binary path with --version to validate it. By setting the pandocBin path to their uploaded script, the attacker can get it to execute.

The combination of these two vulnerabilities allows a remote, authenticated attacker to achieve remote code execution on the SiYuan server.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.