SiYuan has an arbitrary file read and path traversal via /api/export/exportResources
Priority MEDIUM 45CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure. Version 3.1.16 contains a patch for the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00605 49th percentileScored 2026-11-07
Fix Fixed siyuan (siyuan-note): 3.1.16
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| siyuan-note | siyuan | before 3.1.16 | 3.1.16 | Patch available | CNA |
| — | github.com/siyuan-note/siyuan/kernel (Go) | up to 0.0.0-20241210012039-5129ad926a21 | — | No fix listed | GHSA-25w9-wqfq-gwqx |
- siyuan Vendorsiyuan-note Affected before 3.1.16 Fixed in 3.1.16 Patch available CNA
- github.com/siyuan-note/siyuan/kernel (Go) Vendor— Affected up to 0.0.0-20241210012039-5129ad926a21 Fixed in — No fix listed GHSA-25w9-wqfq-gwqx
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:b3log:siyuan:3.1.15:-:*:*:*:*:*:* | 3.1.15 | Vulnerable | siyuan-note |
- cpe:2.3:a:b3log:siyuan:3.1.15:-:*:*:*:*:*:* Versions 3.1.15 Vulnerable ·siyuan-note
Remediation
- Fix · CNA siyuan (siyuan-note) Fixed in 3.1.16
Timeline
- 2026-10-02 Threatist record created from CVE-2024-55658
- 2026-10-03 Alias added: GHSA-25w9-wqfq-gwqx
References
Advisory 2
More siyuan-note Siyuan vulnerabilities
- TI-2026-26050 SiYuan has directory traversal within its publishing service CVSS 3.1CRITICAL 9.8
- TI-2026-25256 SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API CVSS 3.1CRITICAL 9.8
- TI-2024-35827 A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems. CVSS 3.1CRITICAL 9.8
- TI-2024-35826 A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs. CVSS 3.1CRITICAL 9.8
- TI-2024-35825 A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent. CVSS 3.1CRITICAL 9.8
- TI-2024-35824 A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-55658 · CVE Program
- CVE-2024-55658 · NVD
- FIRST EPSS
- GHSA-25w9-wqfq-gwqx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences