CVE-2026-25992
SiYuan has a File Read Interface Case Bypass Vulnerability
Résumé
SiYuan has a File Read Interface Case Bypass Vulnerability
Description d'origine
La description telle que publiée par la source (souvent en anglais).
SiYuan is a personal knowledge management system. Prior to 3.5.5, the /api/file/getFile endpoint uses case-sensitive string equality checks to block access to sensitive files. On case-insensitive file systems such as Windows, attackers can bypass restrictions using mixed-case paths and read protected configuration files. This vulnerability is fixed in 3.5.5.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com