CVE-2026-25992: b3log Siyuan

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

SiYuan is a personal knowledge management system. Prior to 3.5.5, the /api/file/getFile endpoint uses case-sensitive string equality checks to block access to sensitive files. On case-insensitive file systems such as Windows, attackers can bypass restrictions using mixed-case paths and read protected configuration files. This vulnerability is fixed in 3.5.5.

Affected products

• b3log Siyuan: before 3.5.5 (fixed in 3.5.5)

Published 2026-02-10. Last modified 2026-06-17.