Vulnonym.com

CVE-2026-25992 - Foul Effects

Description

SiYuan is a personal knowledge management system. Prior to 3.5.5, the /api/file/getFile endpoint uses case-sensitive string equality checks to block access to sensitive files. On case-insensitive file systems such as Windows, attackers can bypass restrictions using mixed-case paths and read protected configuration files. This vulnerability is fixed in 3.5.5.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Reference

https://github.com/siyuan-note/siyuan/releases/tag/v3.5.5 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f72r-2h5j-7639

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Base Score

7.5

Base Severity

HIGH

Remediation Guide for SiYuan /api/file/getFile Path Traversal Vulnerability

  1. Upgrade to SiYuan v3.5.5 or later
    Immediately update the SiYuan application to version 3.5.5 or any subsequent release, as this version includes the fixed case-insensitive path validation logic.

  2. Validate File Path Input Case-Insensitively
    If custom modifications or forks are in use, ensure all file path validations for /api/file/getFile perform case-insensitive string comparisons when checking against restricted paths (e.g., config.json, .env, private.key).

  3. Implement Allowlist-Based File Access
    Restrict file access to a predefined allowlist of safe, non-sensitive files. Reject all requests that attempt to access files outside this list, regardless of case variations.

  4. Normalize File Paths Before Validation
    Use platform-appropriate path normalization (e.g., Path.GetFullPath() in .NET, os.path.normpath() in Python) to resolve .., ., and case variations before validation.

  5. Enforce File System Permissions
    Ensure the application runs with least-privilege file system permissions and cannot read sensitive configuration files outside its intended data directory.

  6. Log and Monitor Access Attempts
    Enable detailed logging for all /api/file/getFile requests, especially those containing path traversal patterns or case variations. Set up alerts for repeated access attempts to protected files.

  7. Perform Security Testing
    Conduct automated and manual penetration testing using tools like Burp Suite or OWASP ZAP to verify that mixed-case paths (e.g., C:/SiYuan/CoNfIg.Json) are properly blocked.

  8. Review and Patch Third-Party Dependencies
    If SiYuan embeds third-party libraries that handle file access, confirm they are updated and do not introduce similar vulnerabilities.

Context within ISO/IEC 27001 and NIST Frameworks

ISO/IEC 27001 Controls

This vulnerability directly impacts A.9.4.2 – Access control to operating systems and A.13.2.1 – Information transfer policies.

  • A.9.4.2: Requires strict access controls to prevent unauthorized access to system resources — case-insensitive path bypass violates this by allowing privilege escalation via path manipulation.
  • A.13.2.1: Mandates secure handling of information transfers; unfiltered file access via APIs breaches data confidentiality controls.
  • A.12.6.1 – Technical vulnerability management: Failure to patch known vulnerabilities in a timely manner violates this control, which requires systems to be protected against identified technical vulnerabilities.

NIST SP 800-53 Controls

This flaw maps to the following controls:

  • AC-3 (Access Control): System must enforce access restrictions based on user identity and resource sensitivity — bypassing path filters violates least privilege.
  • AC-6 (Least Privilege): Applications must not grant unnecessary access; allowing read access to config files violates this principle.
  • SI-2 (Flaw Remediation): Requires prompt remediation of identified vulnerabilities — failure to upgrade from vulnerable versions violates this control.
  • SI-4 (System Monitoring): Inadequate logging of file access attempts prevents detection and response to exploitation attempts.
  • SI-10 (Information System Monitoring): Requires monitoring for anomalous file access patterns — case-based bypasses should trigger alerts.