2026-02-03 — SiYuan arbitrary file write → RCE (GHSA-c4jr-5q7w-f6r9)¶

What happened: SiYuan had an arbitrary file write via /api/file/copyFile, which can lead to remote code execution.

Why it matters: Arbitrary file write vulnerabilities are frequently exploitable to RCE via: - writing webshells / server-side templates - overwriting startup scripts/config - dropping plugins/extensions

Durable guidance (defensive)¶

For defenders operating self-hosted apps:

1. Patch/upgrade immediately (arbitrary file write is high severity).
2. Reduce blast radius
3. run the service as an unprivileged user
4. containerize and mount application code as read-only
5. Watch for IOCs
6. unexpected file creation outside upload dirs
7. modified startup scripts, cron entries, or plugin directories

References¶

• GitHub Advisory Database: https://github.com/advisories/GHSA-c4jr-5q7w-f6r9