Headline
GHSA-25w9-wqfq-gwqx: SiYuan has an arbitrary file read and path traversal via /api/export/exportResources
Summary
Siyuan’s /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure.
Impact
Arbitrary File Read
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2024-55658
SiYuan has an arbitrary file read and path traversal via /api/export/exportResources
High severity GitHub Reviewed Published Dec 11, 2024 in siyuan-note/siyuan • Updated Dec 11, 2024
Package
gomod github.com/siyuan-note/siyuan/kernel (Go)
Affected versions
<= 0.0.0-20241210012039-5129ad926a21
Summary
Siyuan’s /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure.
Impact
Arbitrary File Read
References
- GHSA-25w9-wqfq-gwqx
- siyuan-note/siyuan@e70ed57
Published to the GitHub Advisory Database
Dec 11, 2024
Last updated
Dec 11, 2024