CVE-2026-23850
Published: 19 January 2026
Summary
CVE-2026-23850 is a high-severity Path Traversal (CWE-22) vulnerability in B3Log Siyuan. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 25.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables unauthenticated remote arbitrary file reads (path traversal) on a public-facing app, directly mapping to local data collection and public app exploitation.
NVD Description
SiYuan is a personal knowledge management system. In versions prior to 3.5.4, the markdown feature allows unrestricted server side html-rendering which allows arbitrary file read (LFD). Version 3.5.4 fixes the issue.
Deeper analysisAI
CVE-2026-23850 is a vulnerability in SiYuan, a personal knowledge management system, affecting versions prior to 3.5.4. The issue lies in the markdown feature, which performs unrestricted server-side HTML rendering, enabling arbitrary file read, referred to as Local File Disclosure (LFD). This is classified under CWE-22 (Path Traversal) with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity due to significant confidentiality impact.
Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation allows reading arbitrary files on the affected server, potentially exposing sensitive data such as configuration files or user information.
SiYuan version 3.5.4 addresses the vulnerability. GitHub references detail the issue in kernel/model/file.go (line 1035), vulnerable code in kernel/api/filetree.go (lines 799-886 for v3.4.2), fixing commits (b2274baba2e11c8cf8901b0c5c871e5b27f1f6dd and f8f4b517077b92c90c0d7b51ac11be1b34b273ad), and the reporting issue (#16860). Security practitioners should upgrade to 3.5.4 or later and review the commits for patch details.
Details
- CWE(s)