CVE-2024-55658CWE-22

SiYuan has an arbitrary file read and path traversal via /api/export/exportResources

High · published December 11, 2024

CVSS v4.0
8.7
EPSS
1%
Percentile
48.3
In the wild
Unconfirmed
What it is

SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure. Version 3.1.16 contains a patch for the issue.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00605 · 48.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-12-11T22:47Z
EPSS history
Timeline
  • 11 DEC 22:47Z
    SiYuan has an arbitrary file read and path traversal via /api/export/exportResources
    cvelistv5