CVE-2025-21609

SiYuan has an arbitrary file deletion vulnerability

State: Published
Severity: 8.7 High
Published: Jan 3, 2025
Updated: Jan 3, 2025
Reserved: Dec 29, 2024

Description

SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the `POST /api/history/getDocHistoryContent` endpoint. An attacker can craft a payload to exploit this vulnerability, resulting in the deletion of arbitrary files on the server. Commit d9887aeec1b27073bec66299a9a4181dc42969f3 fixes this vulnerability and is expected to be available in version 3.1.19.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-459 Incomplete Cleanup
CWE-552 Files or Directories Accessible to External Parties

Affected Products

Product	Versions
siyuansiyuan-note	= 3.1.18Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.