{"id":"GHSA-4r66-7rcv-x46x","summary":"SiYuan vulnerable to RCE via zip slip and Command Injection via PandocBin","details":"### Summary\nSiyuan is vulnerable to RCE. The issue stems from a \"Zip Slip\" vulnerability during zip file extraction, combined with the ability to overwrite system executables and subsequently trigger their execution.\n\n### Steps to reproduce\n1. Authenticate\n2. Create zip slip payload with path traversal entry `../../../../opt/siyuan/startup.sh`. startup.sh contains malicious code like:\n```bash\n#!/bin/sh\necho 'you have been pwned' \u003e /siyuan/workspace/data/pwned.txt\necho \"pandoc 3.1.0\"\n```\n3. Upload zip to workspace via `/api/file/putFile`\n4. Extract zip via `/api/archive/unzip`, overwrites the existing executable `startup.sh` while maintaining the +x permission\n5. Trigger execution by calling `/api/setting/setExport` with `pandocBin=/opt/siyuan/startup.sh`. This calls `IsValidPandocBin()` which executes `startup.sh --version` that outputs \"pandoc 3.1.0\" and executes any arbitrary malicious code","aliases":["GO-2025-4219"],"modified":"2025-12-15T20:41:18.297560Z","published":"2025-12-09T17:18:16Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-22"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2025-12-09T17:18:16Z"},"references":[{"type":"WEB","url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4r66-7rcv-x46x"},{"type":"PACKAGE","url":"https://github.com/siyuan-note/siyuan"}],"affected":[{"package":{"name":"github.com/siyuan-note/siyuan/kernel","ecosystem":"Go","purl":"pkg:golang/github.com/siyuan-note/siyuan/kernel"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.0.0-20251202123337-6ef83b42c7ce"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-4r66-7rcv-x46x/GHSA-4r66-7rcv-x46x.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}