A path traversal vulnerability in SiYuan allows authenticated users to overwrite arbitrary system files, posing a significant risk of remote code execution.

The software fails to properly sanitize zip file paths within the importZipMd function, which constitutes a ZipSlip vulnerability. This allows an authenticated attacker to perform directory traversal and overwrite critical files on the underlying host system.

The ability to overwrite arbitrary files on the host system enables an attacker to gain unauthorized control over the application environment. Given the potential for privilege escalation and remote code execution, this vulnerability carries a CVSS score of 7.8, representing a high risk to data integrity and system availability.

Immediate Action: As a fix is only planned for version 3.5.0, administrators should restrict access to the import functionality to trusted users only or disable the feature if it is not business-critical.

Proactive Monitoring: Review system and application logs for unusual file write operations or unexpected path traversal patterns, particularly those originating from the import module.

Compensating Controls: Implement strict file system permissions for the user account running the SiYuan service to limit the impact of potential file overwrites, and utilize a Web Application Firewall to inspect incoming zip archives for malicious structures.

Public Exploit Available: No

This vulnerability presents a severe risk to self-hosted environments. Organizations must prioritize monitoring the SiYuan GitHub repository for the release of version 3.5.0 and apply the update immediately upon availability to remediate the underlying flaw.