CVE-2026-23851

SiYuan is a personal knowledge management system. Versions prior to 3.5.4 contain a logic vulnerability in the /api/file/globalCopyFiles endpoint. The function allows authenticated users to copy files from any location on the server's filesystem into the application's workspace without proper path validation. The vulnerability exists in the api/file.go source code. The function globalCopyFiles accepts a list of source paths (srcs) from the JSON request body. While the code checks if the source file exists using filelock.IsExist(src), it fails to validate whether the source path resides within the authorized workspace directory. Version 3.5.4 patches the issue.

• CWE-22

• https://github.com/siyuan-note/siyuan/commit/b2274baba2e11c8cf8901b0c5c871e5b27f1f6ddPatch
• https://github.com/siyuan-note/siyuan/commit/f8f4b517077b92c90c0d7b51ac11be1b34b273adPatch
• https://github.com/siyuan-note/siyuan/issues/16860Issue Tracking, Patch
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-94c7-g2fj-7682Exploit, Patch, Vendor Advisory

Published

Jan 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23846Tugtainer is a self-hosted app for automating updates of Doc…9.1
• CVE-2026-23847SiYuan is a personal knowledge management system. Versions p…6.1
• CVE-2026-23848MyTube is a self-hosted downloader and player for several vi…5.3
• CVE-2026-23849File Browser provides a file managing interface within a spe…5.3
• CVE-2026-2385The The Plus Addons for Elementor – Addons for Elementor, Pa…5.3
• CVE-2026-23850SiYuan is a personal knowledge management system. In version…7.5
• CVE-2026-23852SiYuan is a personal knowledge management system. Versions p…9.6
• CVE-2026-23853Dell PowerProtect Data Domain with Data Domain Operating Sys…8.4
• CVE-2026-23856Dell iDRAC Service Module (iSM) for Windows, versions prior …7.8
• CVE-2026-23857Dell Update Package (DUP) Framework, versions 23.12.00 throu…8.2
• CVE-2026-23858Dell Wyse Management Suite, versions prior to WMS 5.5, conta…5.4
• CVE-2026-23859Dell Wyse Management Suite, versions prior to WMS 5.5, conta…2.7