GitHub Advisoryadvisory · Go

GHSA-xx68-37v4-4596 SiYuan has an arbitrary file read via /api/template/render

HIGH Published 2024-12-11 Modified 2025-06-05 Official page ↗
Aliases
CVE-2024-55657
Ecosystem
Go
Packages
github.com/siyuan-note/siyuan/kernel
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2024-12-11

Affected packages

• Go github.com/siyuan-note/siyuan/kernel: <= 0.0.0-20241210012039-5129ad926a21 (no fix yet)

Description

Summary An arbitrary file read vulnerability exists in Siyuan's /api/template/render endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. Impact Arbitrary file read on the host

Related

Alias · CVE (1)

  • CVE-2024-55657 SiYuan is a personal knowledge management system. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References