GHSA-4r66-7rcv-x46x
Suggest an improvement- Source
- https://github.com/advisories/GHSA-4r66-7rcv-x46x
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-4r66-7rcv-x46x/GHSA-4r66-7rcv-x46x.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-4r66-7rcv-x46x
- Aliases
- Published
- 2025-12-09T17:18:16Z
- Modified
- 2025-12-15T20:41:18Z
- Severity
-
- 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin
- Details
-
Summary
Siyuan is vulnerable to RCE. The issue stems from a "Zip Slip" vulnerability during zip file extraction, combined with the ability to overwrite system executables and subsequently trigger their execution.
Steps to reproduce
- Authenticate
- Create zip slip payload with path traversal entry
../../../../opt/siyuan/startup.sh. startup.sh contains malicious code like:
#!/bin/sh echo 'you have been pwned' > /siyuan/workspace/data/pwned.txt echo "pandoc 3.1.0"- Upload zip to workspace via
/api/file/putFile - Extract zip via
/api/archive/unzip, overwrites the existing executablestartup.shwhile maintaining the +x permission - Trigger execution by calling
/api/setting/setExportwithpandocBin=/opt/siyuan/startup.sh. This callsIsValidPandocBin()which executesstartup.sh --versionthat outputs "pandoc 3.1.0" and executes any arbitrary malicious code
- Database specific
{ "cwe_ids": [ "CWE-22" ], "github_reviewed": true, "github_reviewed_at": "2025-12-09T17:18:16Z", "nvd_published_at": null, "severity": "HIGH" }- References
Affected packages
Go / github.com/siyuan-note/siyuan/kernel
Package
- Name
- github.com/siyuan-note/siyuan/kernel
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/siyuan-note/siyuan/kernel