CVE-2024-55658

CVSS V2 None CVSS V3 None

Description

SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure. Version 3.1.16 contains a patch for the issue.

Overview

CVE ID
CVE-2024-55658

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-12-11T22:47:21.809Z

Last Modified Date
2024-12-11T22:47:21.809Z

Weakness Enumerations

CWE	URL
CWE-22	http://cwe.mitre.org/data/definitions/22.html

References

Reference URL	Reference Tags
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-25w9-wqfq-gwqx	x_refsource_CONFIRM
https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-55658
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-55658

History

Created	Old Value	New Value	Data Type	Notes
2024-12-12 13:26:17				Added to TrackCVE