CVE-2026-25992 SiYuan has a File Read Interface Case Bypass Vulnerability

What is CVE-2026-25992?

CVE-2026-25992 is a high-severity path traversal vulnerability in B3log Siyuan, published on 10 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SiYuan is a personal knowledge management system. Prior to 3.5.5, the /api/file/getFile endpoint uses case-sensitive string equality checks to block access to sensitive files. On case-insensitive file systems such as Windows, attackers can bypass restrictions using mixed-case paths and read protected configuration files. This vulnerability is fixed in 3.5.5.

Weakness: CWE-22

Which versions are affected by CVE-2026-25992?

3 open source packages ship an affected version, including github.com/siyuan-note/siyuan/kernel. It affects 1 product.

Products include B3log Siyuan.

How do I fix CVE-2026-25992?

No fix has been published for CVE-2026-25992 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-25992 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25992 exists.

Other vulnerabilities in B3log Siyuan

• CVE-2026-32938 SiYuan has an Arbitrary File Read in its Desktop Publish Service Critical 9.9
• CVE-2026-33669 SiYuan has Arbitrary Document Reading within the Publishing Service Critical 9.8
• CVE-2026-33670 SiYuan has directory traversal within its publishing service Critical 9.8
• CVE-2026-32767 SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API Critical 9.8
• CVE-2024-53504 SQL injection in n/a Critical 9.8

All B3log Siyuan vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f72r-2h5j-7639, GO-2026-4386.