CVE-2026-23850

Description

SiYuan vulnerable to Arbitrary file Read / SSRF in github.com/siyuan-note/siyuan/kernel

How to fix CVE-2026-23850

To remediate CVE-2026-23850, upgrade the affected package to a fixed version below.

• Go/github.com/siyuan-note/siyuan/kernel—upgrade to 0.0.0-20260118092326-b2274baba2e1 or later
• Go/github.com/siyuan-note/siyuan/kernel—upgrade to 0.0.0-20260118092326-b2274baba2e1 or later

Is CVE-2026-23850 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 0.0.0-20260118092326-b2274baba2e1
• from 0, < 0.0.0-20260118092326-b2274baba2e1

CVSS scores

References (8)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-23850
• PATCHgithub.com/siyuan-note/siyuan
• WEBgithub.com/siyuan-note/siyuan/blob/master/kernel/model/file.go#L1035
• WEBgithub.com/siyuan-note/siyuan/blob/v3.4.2/kernel/api/filetree.go#L799-L886