GHSA-4r66-7rcv-x46x

Опубликовано: 09 дек. 2025

Источник: github

Github: Прошло ревью

CVSS4: 8.6

Описание

SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin

Summary

Siyuan is vulnerable to RCE. The issue stems from a "Zip Slip" vulnerability during zip file extraction, combined with the ability to overwrite system executables and subsequently trigger their execution.

Steps to reproduce

Authenticate
Create zip slip payload with path traversal entry ../../../../opt/siyuan/startup.sh. startup.sh contains malicious code like:

#!/bin/sh echo 'you have been pwned' > /siyuan/workspace/data/pwned.txt echo "pandoc 3.1.0"

Upload zip to workspace via /api/file/putFile
Extract zip via /api/archive/unzip, overwrites the existing executable startup.sh while maintaining the +x permission
Trigger execution by calling /api/setting/setExport with pandocBin=/opt/siyuan/startup.sh. This calls IsValidPandocBin() which executes startup.sh --version that outputs "pandoc 3.1.0" and executes any arbitrary malicious code

Ссылки

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4r66-7rcv-x46x

Пакеты

Наименование

github.com/siyuan-note/siyuan/kernel

Затронутые версииВерсия исправления

<= 0.0.0-20251202123337-6ef83b42c7ce

Отсутствует

8.6 High

CVSS4

Дефекты

CWE-22

8.6 High

CVSS4

Дефекты

CWE-22