An authenticated user can invoke the /api/file/copyFile endpoint to write a file to an arbitrary location on the host because the destination path is not validated. This missing path‑validation allows overwriting critical system files such as cron jobs, SSH authorized_keys, or shell configuration files, which can be exploited to execute arbitrary code on the device. The weakness corresponds to Path Traversal (CWE‑22).

SiYuan, a personal knowledge management system, is affected for all releases prior to version 3.5.5. Any deployment that has authentication enabled and has not upgraded to the patched release remains vulnerable.

The CVSS base score is 9.1, indicating a high severity vulnerability, but the EPSS score is below 1 %, signifying a very low projected exploitation probability at the present time. The vulnerability is not listed in the CISA KEV catalog. An attacker requires valid authentication and access to the API; once the arbitrary write is achieved, the attacker can place malicious binaries or scripts in system directories where execution is triggered, enabling remote code execution.