PT-2025-62938 · Go · Github.Com/Siyuan-Note/Siyuan/Kernel

Publicado

2025-12-09

·

Atualizado

2025-12-09

CVSS v4.0

8.6

Alta

VetorAV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

Siyuan is vulnerable to RCE. The issue stems from a "Zip Slip" vulnerability during zip file extraction, combined with the ability to overwrite system executables and subsequently trigger their execution.

Steps to reproduce

  1. Authenticate
  2. Create zip slip payload with path traversal entry ../../../../opt/siyuan/startup.sh. startup.sh contains malicious code like:
bash
#!/bin/sh
echo 'you have been pwned' > /siyuan/workspace/data/pwned.txt
echo "pandoc 3.1.0"
  1. Upload zip to workspace via /api/file/putFile
  2. Extract zip via /api/archive/unzip, overwrites the existing executable startup.sh while maintaining the +x permission
  3. Trigger execution by calling /api/setting/setExport with pandocBin=/opt/siyuan/startup.sh. This calls IsValidPandocBin() which executes startup.sh --version that outputs "pandoc 3.1.0" and executes any arbitrary malicious code

Correção

Path traversal

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

GHSA-4R66-7RCV-X46X

Produtos afetados

Github.Com/Siyuan-Note/Siyuan/Kernel