Critical · published February 4, 2026
🚨 A sneaky flaw in SiYuan’s file handling could let authenticated users write files anywhere on the server! 🔥 Think of it like an office worker having access to a copy machine that can also print to the boss’s personal files — if they’re not careful, sensitive documents could be rewritten or even deleted without permission! This vulnerability could lead to absolute chaos: imagine an attacker planting malicious scripts in cron jobs or altering SSH keys, allowing unauthorized access to the system. The potential for Remote Code Execution (RCE) turns this misstep into a security nightmare, jeopardizing the integrity of the entire system.
Think of it like an office worker having access to a copy machine that can also print to the boss’s personal files — if they’re not careful, sensitive documents could be rewritten or even deleted without permission! Before version 3.5.5, SiYuan's /api/file/copyFile endpoint fails to validate the destination parameter, allowing authenticated users to write files to any location on the filesystem without restrictions.
This vulnerability could lead to absolute chaos: imagine an attacker planting malicious scripts in cron jobs or altering SSH keys, allowing unauthorized access to the system. The potential for Remote Code Execution (RCE) turns this misstep into a security nightmare, jeopardizing the integrity of the entire system. Upgrade to SiYuan version 3.5.5 immediately to close this vulnerability. Review access controls to ensure only necessary permissions are granted to authenticated users, and consider implementing additional validation on file operations. You've got this! Just follow the steps, and you’ll have your system secure in no time. 🛡️