Listen to this Post
The vulnerability in SiYuan note software enables remote code execution through a chain of zip slip and command injection flaws. During zip file extraction via the /api/archive/unzip endpoint, path traversal sequences like “../../../../” are not sanitized, allowing arbitrary file writes. An attacker can craft a zip archive containing a malicious script targeting critical system executables, such as /opt/siyuan/startup.sh. When extracted, this script overwrites the original file while preserving execute permissions. Subsequently, the /api/setting/setExport endpoint can be abused by setting the pandocBin parameter to the malicious script path. The application’s IsValidPandocBin() function validates the pandoc binary by executing it with the –version argument. This triggers the malicious script, which outputs a fake version string like “pandoc 3.1.0” while executing embedded arbitrary code. The issue stems from insufficient input validation in zip handling and unsafe command execution via pandocBin. Affected versions lack proper checks for file paths during extraction and command arguments during validation. This combination allows authenticated remote attackers to achieve full system compromise. The vulnerability is documented in the GitHub Advisory Database with detailed reproduction steps. No patched versions are available as of the report date, making it critical for users to apply mitigations.
Platform: SiYuan
Version: <=20251202123337
Vulnerability: RCE zip slip
Severity: High
Date: Dec 8, 2025
Prediction: Patch date unknown
What Undercode Say:
Analytics:
Craft malicious zip: zip -r evil.zip ../../../../opt/siyuan/startup.sh
Upload file: curl -X POST /api/file/putFile -F “[email protected]”
Extract zip: curl -X POST /api/archive/unzip -d “path=/target”
Set pandocBin: curl -X POST /api/setting/setExport -d “pandocBin=/opt/siyuan/startup.sh”
Malicious startup.sh: !/bin/bash
echo “pandoc 3.1.0”
malicious_command
How Exploit:
Overwrite startup.sh via zip slip, then execute via pandocBin validation.
Protection from this CVE:
Apply path validation, sanitize inputs, restrict permissions, update when patched.
Impact:
Remote code execution, system compromise, data breach.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
