CVE-2024-55658: SiYuan has an arbitrary file read and path traversal via /api/export/exportResources

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-12 · updated 2026-06-17
Weakness: CWE-22

Description

SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure. Version 3.1.16 contains a patch for the issue.

Affected products

siyuan-note siyuan: 3.1.15

References

https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-25w9-wqfq-gwqx

Get alerted when CVE-2024-55658 or the next vulnerability affects your stack