CVE-2025-67488

SiYuan is self-hosted, open source personal knowledge management software. Versions 0.0.0-20251202123337-6ef83b42c7ce and below contain function importZipMd which is vulnerable to ZipSlips, allowing an authenticated user to overwrite files on the system. An authenticated user with access to the import functionality in notes is able to overwrite any file on the system, and can escalate to full code execution under some circumstances. A fix is planned for version 3.5.0.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/siyuan-note/siyuan/blob/dae6158860cc704e353454565c96e874278c6f47/kernel/api/import.go#L190	Product
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gqfv-g4v7-m366	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*

History

14 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) SiYuan es un software de gestión de conocimiento personal autoalojado y de código abierto. Las versiones 0.0.0-20251202123337-6ef83b42c7ce e inferiores contienen la función importZipMd, que es vulnerable a ZipSlips, permitiendo a un usuario autenticado sobrescribir archivos en el sistema. Un usuario autenticado con acceso a la funcionalidad de importación en las notas puede sobrescribir cualquier archivo en el sistema y puede escalar a ejecución de código completa bajo algunas circunstancias. Una solución está planeada para la versión 3.5.0.

Information

Published : 2025-12-09 21:16

Updated : 2026-10-14 21:10

NVD link : CVE-2025-67488

Mitre link : CVE-2025-67488

CVE.ORG link : CVE-2025-67488

JSON object : View

Products Affected

b3log

siyuan

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2025-67488", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67488", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-09T21:29:53.279279Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "siyuan-note", "product": "siyuan", "versions": [{"status": "affected", "version": "<= 0.0.0-20251202123337-6ef83b42c7ce"}]}]}], "published": "2025-12-09T21:16:00.317", "references": [{"url": "https://github.com/siyuan-note/siyuan/blob/dae6158860cc704e353454565c96e874278c6f47/kernel/api/import.go#L190", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-gqfv-g4v7-m366", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "SiYuan is self-hosted, open source personal knowledge management software. Versions 0.0.0-20251202123337-6ef83b42c7ce and below contain function importZipMd which is vulnerable to ZipSlips, allowing an authenticated user to overwrite files on the system. An authenticated user with access to the import functionality in notes is able to overwrite any file on the system, and can escalate to full code execution under some circumstances. A fix is planned for version 3.5.0."}, {"lang": "es", "value": "SiYuan es un software de gesti\u00f3n de conocimiento personal autoalojado y de c\u00f3digo abierto. Las versiones 0.0.0-20251202123337-6ef83b42c7ce e inferiores contienen la funci\u00f3n importZipMd, que es vulnerable a ZipSlips, permitiendo a un usuario autenticado sobrescribir archivos en el sistema. Un usuario autenticado con acceso a la funcionalidad de importaci\u00f3n en las notas puede sobrescribir cualquier archivo en el sistema y puede escalar a ejecuci\u00f3n de c\u00f3digo completa bajo algunas circunstancias. Una soluci\u00f3n est\u00e1 planeada para la versi\u00f3n 3.5.0."}], "lastModified": "2026-10-14T21:10:00.183", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "66019619-6B6D-47D8-9546-9E3AF6053473", "versionEndExcluding": "3.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}