CVE-2024-55658
published 2024-12-12CVE-2024-55658: SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read…
PriorityP349high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.58%
43.6th percentile
SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure. Version 3.1.16 contains a patch for the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| b3log | siyuan | — | — |
| github.com | siyuan-note_siyuan_kernel | 0 – 0.0.0-20241210012039-5129ad926a21 | — |
| siyuan-note | siyuan | < 3.1.16 | 3.1.16 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel
osv·2024-12-12
CVE-2024-55658 SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel
SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel
SiYuan has an arbitrary file read and path traversal via /api/export/exportResources in github.com/siyuan-note/siyuan/kernel
OSV
SiYuan has an arbitrary file read and path traversal via /api/export/exportResources
osv·2024-12-11
CVE-2024-55658 [HIGH] SiYuan has an arbitrary file read and path traversal via /api/export/exportResources
SiYuan has an arbitrary file read and path traversal via /api/export/exportResources
### Summary
Siyuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure.
### Impact
Arbitrary File Read
GHSA
SiYuan has an arbitrary file read and path traversal via /api/export/exportResources
ghsa·2024-12-11
CVE-2024-55658 [HIGH] CWE-22 SiYuan has an arbitrary file read and path traversal via /api/export/exportResources
SiYuan has an arbitrary file read and path traversal via /api/export/exportResources
### Summary
Siyuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure.
### Impact
Arbitrary File Read
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-12-12
Published