CVE-2026-23851: High Vulnerability in b3log SiYuan

CVE-2026-23851 is a high-severity logic vulnerability discovered in b3log's SiYuan, a personal knowledge management system. This vulnerability allows authenticated users to copy files from any location on the server's filesystem into the application's workspace without proper path validation. The core issue resides in the /api/file/globalCopyFiles endpoint, specifically within the api/file.go source code. The function globalCopyFiles accepts a list of source paths from a JSON request body, but it fails to validate whether the source path is within the authorized workspace directory.

The vulnerability was officially disclosed on January 19, 2026, and affects all versions prior to 3.5.4, which has been patched. Due to the potential for unauthorized file access, organizations using SiYuan should prioritize remediation of this vulnerability to protect sensitive data.

With a CVSS score of 8.3, this vulnerability poses significant risks, especially considering its high impact on confidentiality. Organizations must address this flaw urgently to mitigate exploitation risks.

Currently, there are no known public exploits or proofs of concept associated with CVE-2026-23851, but the absence of such information does not diminish the risk. Organizations should implement the necessary patches as soon as possible.

Organizations should prioritize patching immediately.

The urgency of addressing this vulnerability cannot be overstated, given the potential for unauthorized access to sensitive files within the application.

Vulnerability Details

This vulnerability allows authenticated users to copy files from any location on the server's filesystem into the application's workspace without proper path validation. The vulnerability exists in the api/file.go source code. The function globalCopyFiles accepts a list of source paths (srcs) from the JSON request body. While the code checks if the source file exists using filelock.IsExist(src), it fails to validate whether the source path resides within the authorized workspace directory. Version 3.5.4 patches the issue.

Severity: High (CVSS 8.3) - This indicates a significant risk due to the potential confidentiality impacts, allowing unauthorized access to sensitive files.

Technical Analysis

The root cause of CVE-2026-23851 lies in the insufficient validation of file paths in the globalCopyFiles function. The attack vector is network-based, and the attack complexity is low, meaning that an attacker with authenticated access can exploit this vulnerability easily. Privileges required are low, and there is no user interaction necessary to exploit this flaw. The potential confidentiality impact is high, as sensitive files can be accessed, copied, and potentially exfiltrated.

Risk & Impact Analysis

The risk to organizations includes unauthorized access to sensitive information and potential data breaches. The vulnerability's high CVSS score indicates that exploitation could have serious implications on data confidentiality. The blast radius may extend to any files accessible via the compromised endpoint, emphasizing the need for immediate remediation.

Exploitation Status

Affected Versions

All versions of SiYuan prior to version 3.5.4 are affected by this vulnerability. Organizations should ensure they update to the latest version to mitigate risks.

Mitigation & Remediation

To mitigate this vulnerability, organizations should upgrade to SiYuan version 3.5.4 or later. If immediate patching is not feasible, consider implementing additional access controls to limit the exposure of the /api/file/globalCopyFiles endpoint. Regularly review and harden configurations to prevent unauthorized access.

For security testing, organizations should consider performing a penetration test to validate the effectiveness of the patch and identify any remaining vulnerabilities.

Detection Guidance

Monitoring logs for unusual file access patterns and reviewing API access logs can help detect potential exploitation attempts. Look for any unexpected file copies or access to sensitive directories.

AppSecure Threat Intelligence Insight

CVE-2026-23851 highlights the importance of proper path validation in web applications. As organizations increasingly rely on web services, ensuring that endpoints enforce strict access controls is paramount. Security teams should regularly assess their applications for similar vulnerabilities to stay ahead of potential threats. For comprehensive security assessments, refer to our application security assessment services.

Additionally, for best practices on securing web applications, refer to our web application security testing guide.

Organizations are encouraged to stay informed about vulnerabilities and patches, leveraging services that provide continuous monitoring and updates for their applications. For ongoing security practices, explore our vulnerability management program design.