Nixpkgs security tracker

Untriaged

Permalink CVE-2026-23850

created 2 months, 4 weeks ago

SiYuan vulnerable to arbitrary file read

SiYuan is a personal knowledge management system. In versions prior to 3.5.4, the markdown feature allows unrestricted server side html-rendering which allows arbitrary file read (LFD). Version 3.5.4 fixes the issue.

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-cv54-7wv7-qxcw x_refsource_CONFIRM
https://github.com/siyuan-note/siyuan/issues/16860 x_refsource_MISC
https://github.com/siyuan-note/siyuan/commit/b2274baba2e11c8cf8901b0c5c871e5b27f1f6dd x_refsource_MISC
https://github.com/siyuan-note/siyuan/commit/f8f4b517077b92c90c0d7b51ac11be1b34b273ad x_refsource_MISC
https://github.com/siyuan-note/siyuan/blob/master/kernel/model/file.go#L1035 x_refsource_MISC
https://github.com/siyuan-note/siyuan/blob/v3.4.2/kernel/api/filetree.go#L799-L886 x_refsource_MISC

Affected products

siyuan

==< 3.5.4

Matching in nixpkgs

pkgs.siyuan

Privacy-first personal knowledge management system that supports complete offline usage, as well as end-to-end encrypted data sync

nixos-unstable 3.2.1
- nixpkgs-unstable 3.2.1
- nixos-unstable-small 3.2.1
nixos-25.11 3.4.0
- nixpkgs-25.11-darwin 3.4.0

Package maintainers

@L-Trump Luo Chen <ltrump@163.com>
@TomaSajt TomaSajt

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.siyuan

Package maintainers