---
id: CVE-2025-68948
title: 'SiYuan is self-hosted, open source personal knowledge management software'
summary: >-
  SiYuan is self-hosted, open source personal knowledge management software. In
  versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded
  cryptographic secret for its session store. This unsafe practice renders the
  session…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-321
  - CWE-798
vendor: b3log
product: siyuan
affected:
  - siyuan < 3.5.2
patched:
  - siyuan 3.5.2
published: '2025-12-27'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T09:10:00.323'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-68948'
references:
  - url: >-
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f7ph-rc3w-qp28
    label: security-advisories@github.com
  - url: >-
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f7ph-rc3w-qp28
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00221
epssPercentile: 0.11633
ingestedAt: '2026-10-13T09:20:23.160Z'
---

## Overview

SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded cryptographic secret for its session store. This unsafe practice renders the session encryption ineffective. Since the sensitive AccessAuthCode is stored within the session cookie, an attacker who intercepts or obtains a user's encrypted session cookie (e.g., via session hijacking) can locally decrypt it using the public key. Once decrypted, the attacker can retrieve the AccessAuthCode in plain text and use it to authenticate or take over the session.

## Affected

- `siyuan < 3.5.2`

## Remediation

Upgrade past the affected range:

- `siyuan 3.5.2`