CVE-2026-23850
Published: 19 January 2026
Summary
CVE-2026-23850 is a high-severity Path Traversal (CWE-22) vulnerability in B3Log Siyuan. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 40.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-23850 is a vulnerability in SiYuan, a personal knowledge management system, affecting versions prior to 3.5.4. The issue lies in the markdown feature, which performs unrestricted server-side HTML rendering, enabling arbitrary file read, referred to as Local File Disclosure (LFD). This is classified under CWE-22 (Path Traversal) with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity due to significant confidentiality impact.
Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation allows reading arbitrary files on the affected server, potentially exposing sensitive data such as configuration files or user information.
SiYuan version 3.5.4 addresses the vulnerability. GitHub references detail the issue in kernel/model/file.go (line 1035), vulnerable code in kernel/api/filetree.go (lines 799-886 for v3.4.2), fixing commits (b2274baba2e11c8cf8901b0c5c871e5b27f1f6dd and f8f4b517077b92c90c0d7b51ac11be1b34b273ad), and the reporting issue (#16860). Security practitioners should upgrade to 3.5.4 or later and review the commits for patch details.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3292
Vulnerability details
SiYuan is a personal knowledge management system. In versions prior to 3.5.4, the markdown feature allows unrestricted server side html-rendering which allows arbitrary file read (LFD). Version 3.5.4 fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables unauthenticated remote arbitrary file reads (path traversal) on a public-facing app, directly mapping to local data collection and public app exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents exploitation of the path traversal vulnerability in the markdown feature by validating inputs to block arbitrary file read attempts.
Requires timely identification, reporting, and patching of the specific flaw in SiYuan versions prior to 3.5.4 that enables LFD via unrestricted server-side HTML rendering.
Enforces logical access controls on server file resources, limiting the scope of arbitrary file reads even if path traversal occurs.