Every CVESearch/Get API key

GHSA-4r66-7rcv-x46x

SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin

8.6 High

GHSA-4r66-7rcv-x46x is a high vulnerability (CVSS 8.6) in github.com/siyuan-note/siyuan/kernel, published December 9, 2025. No source lists public exploit code. No source names a fixed version.

Severity
8.6 HighCVSS 4.0, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

Summary

Siyuan is vulnerable to RCE. The issue stems from a "Zip Slip" vulnerability during zip file extraction, combined with the ability to overwrite system executables and subsequently trigger their execution.

Steps to reproduce

  1. Authenticate
  2. Create zip slip payload with path traversal entry ../../../../opt/siyuan/startup.sh. startup.sh contains malicious code like:
#!/bin/sh
echo 'you have been pwned' > /siyuan/workspace/data/pwned.txt
echo "pandoc 3.1.0"
  1. Upload zip to workspace via /api/file/putFile
  2. Extract zip via /api/archive/unzip, overwrites the existing executable startup.sh while maintaining the +x permission
  3. Trigger execution by calling /api/setting/setExport with pandocBin=/opt/siyuan/startup.sh. This calls IsValidPandocBin() which executes startup.sh --version that outputs "pandoc 3.1.0" and executes any arbitrary malicious code

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Affected packages

Affected packages
PackageAffectedFixed
github.com/siyuan-note/siyuan/kernel
Go
through 0.0.0-20251202123337-6ef83b42c7ceNone known
github.com/siyuan-note/siyuan/kernel
Go
All versionsNone known

What each source reports

GitHub Advisories Score used8.6

SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin

Summary

Siyuan is vulnerable to RCE. The issue stems from a "Zip Slip" vulnerability during zip file extraction, combined with the ability to overwrite system executables and subsequently trigger their execution.

Steps to reproduce

  1. Authenticate
  2. Create zip slip payload with path traversal entry ../../../../opt/siyuan/startup.sh. startup.sh contains malicious code like:
#!/bin/sh
echo 'you have been pwned' > /siyuan/workspace/data/pwned.txt
echo "pandoc 3.1.0"
  1. Upload zip to workspace via /api/file/putFile
  2. Extract zip via /api/archive/unzip, overwrites the existing executable startup.sh while maintaining the +x permission
  3. Trigger execution by calling /api/setting/setExport with pandocBin=/opt/siyuan/startup.sh. This calls IsValidPandocBin() which executes startup.sh --version that outputs "pandoc 3.1.0" and executes any arbitrary malicious code
Record
GHSA-4r66-7rcv-x46x
CVSS 4.0
8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
OSV8.6

SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin

Summary

Siyuan is vulnerable to RCE. The issue stems from a "Zip Slip" vulnerability during zip file extraction, combined with the ability to overwrite system executables and subsequently trigger their execution.

Steps to reproduce

  1. Authenticate
  2. Create zip slip payload with path traversal entry ../../../../opt/siyuan/startup.sh. startup.sh contains malicious code like:
#!/bin/sh
echo 'you have been pwned' > /siyuan/workspace/data/pwned.txt
echo "pandoc 3.1.0"
  1. Upload zip to workspace via /api/file/putFile
  2. Extract zip via /api/archive/unzip, overwrites the existing executable startup.sh while maintaining the +x permission
  3. Trigger execution by calling /api/setting/setExport with pandocBin=/opt/siyuan/startup.sh. This calls IsValidPandocBin() which executes startup.sh --version that outputs "pandoc 3.1.0" and executes any arbitrary malicious code
Record
GHSA-4r66-7rcv-x46x
CVSS 4.0
8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-22
Updated
2026-11-02
OSVGO-2025-4219No score

SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin in github.com/siyuan-note/siyuan/kernel

SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin in github.com/siyuan-note/siyuan/kernel

Record
GO-2025-4219
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open