HIGH🇵🇱 Wersja polska

CVE-2025-21609

CVSS 8.7v4.0pub. 2025-01-03upd. 2025-05-14

SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the `POST /api/history/getDocHistoryContent` endpoint. An attacker can craft a payload to exploit this vulnerability, resulting in the deletion of arbitrary files on the server. Commit d9887aeec1b27073bec66299a9a4181dc42969f3 fixes this vulnerability and is expected to be available in version 3.1.19.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • B3log Siyuan

    APP
    B3Log
    3.1.18
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-40322CRITICAL9.0PL ✓ten sam produkt

B3Log SiYuan: XSS w diagramach Mermaid eskaluje do RCE w Electron

CVE-2026-39846CRITICAL9.0PL ✓ten sam produkt

RCE przez stored XSS w kliencie desktopowym B3Log SiYuan

CVE-2026-34449CRITICAL9.6PL ✓ten sam produkt

RCE w SiYuan poprzez nadmiernie permisywną politykę CORS

CVE-2026-34448CRITICAL9.0PL ✓ten sam produkt

Stored XSS → RCE w B3Log SiYuan via złośliwy URL w Attribute View

CVE-2026-33670CRITICAL9.8PL ✓ten sam produkt

Path Traversal w B3Log SiYuan — nieautoryzowane odczytywanie struktury plików