Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0yNXc5LXdxZnEtZ3dxeM4ABCSZ

SiYuan has an arbitrary file read and path traversal via /api/export/exportResources

Summary

Siyuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure.

Impact

Arbitrary File Read

Permalink: https://github.com/advisories/GHSA-25w9-wqfq-gwqx
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yNXc5LXdxZnEtZ3dxeM4ABCSZ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 7 days ago
Updated: 6 days ago

EPSS Percentage: 0.00044
EPSS Percentile: 0.1207

Identifiers: GHSA-25w9-wqfq-gwqx, CVE-2024-55658
References:

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-25w9-wqfq-gwqx
• https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71
• https://nvd.nist.gov/vuln/detail/CVE-2024-55658
• https://pkg.go.dev/vuln/GO-2024-3323
• https://github.com/advisories/GHSA-25w9-wqfq-gwqx

Repository: https://github.com/siyuan-note/siyuan
Blast Radius: 1.0

Affected Packages