CVE-2024-55657: SiYuan has an arbitrary file read via /api/template/render
Summary
An arbitrary file read vulnerability exists in Siyuan's /api/template/render endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system.
Impact
Arbitrary file read on the host
Other sources
SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's /api/template/render endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. Version 3.1.16 contains a patch for the issue.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55657?
CVE-2024-55657 is classified as a high severity vulnerability due to its potential for arbitrary file read access.
How do I fix CVE-2024-55657?
To fix CVE-2024-55657, update the Siyuan application to a version that addresses the arbitrary file read vulnerability.
What is the impact of CVE-2024-55657?
The impact of CVE-2024-55657 includes the potential exposure of sensitive files on the host system due to improper validation of the path parameter.
What software is affected by CVE-2024-55657?
CVE-2024-55657 affects the Siyuan application version 0.0.0-20241210012039-5129ad926a21 and earlier.
Is CVE-2024-55657 exploitable remotely?
Yes, CVE-2024-55657 can be exploited remotely by an attacker who can send requests to the vulnerable endpoint.