GitHub Advisoryadvisory · Go

GHSA-25w9-wqfq-gwqx SiYuan has an arbitrary file read and path traversal via /api/export/exportResources

HIGH Published 2024-12-11 Modified 2025-06-05 Official page ↗
Aliases
CVE-2024-55658
Ecosystem
Go
Packages
github.com/siyuan-note/siyuan/kernel
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2024-12-11

Affected packages

• Go github.com/siyuan-note/siyuan/kernel: <= 0.0.0-20241210012039-5129ad926a21 (no fix yet)

Description

Summary Siyuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure. Impact Arbitrary File Read

Related

Alias · CVE (1)

  • CVE-2024-55658 SiYuan is a personal knowledge management system. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References