{"id":"GHSA-4r66-7rcv-x46x","aliases":["GO-2025-4219"],"url":"https://o3.security/vulnerability/GHSA-4r66-7rcv-x46x","summary":"SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin","details":"### Summary\nSiyuan is vulnerable to RCE. The issue stems from a \"Zip Slip\" vulnerability during zip file extraction, combined with the ability to overwrite system executables and subsequently trigger their execution.\n\n### Steps to reproduce\n1. Authenticate\n2. Create zip slip payload with path traversal entry `../../../../opt/siyuan/startup.sh`. startup.sh contains malicious code like:\n```bash\n#!/bin/sh\necho 'you have been pwned' > /siyuan/workspace/data/pwned.txt\necho \"pandoc 3.1.0\"\n```\n3. Upload zip to workspace via `/api/file/putFile`\n4. Extract zip via `/api/archive/unzip`, overwrites the existing executable `startup.sh` while maintaining the +x permission\n5. Trigger execution by calling `/api/setting/setExport` with `pandocBin=/opt/siyuan/startup.sh`. This calls `IsValidPandocBin()` which executes `startup.sh --version` that outputs \"pandoc 3.1.0\" and executes any arbitrary malicious code","published":"2025-12-09T17:18:16Z","modified":"2025-12-15T20:41:18.297560Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4r66-7rcv-x46x"},{"type":"PACKAGE","url":"https://github.com/siyuan-note/siyuan"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-12-15T20:41:18.297560Z"}}