CVE-2024-55658: SiYuan has an arbitrary file read and path traversal via /api/export/exportResources
Summary
Siyuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure.
Impact Arbitrary File Read
Other sources
SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure. Version 3.1.16 contains a patch for the issue.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55658?
CVE-2024-55658 is considered a high severity vulnerability due to its ability to allow arbitrary file read via path traversal.
How do I fix CVE-2024-55658?
To fix CVE-2024-55658, you should update to the latest version of Siyuan that includes the necessary patches.
What systems are affected by CVE-2024-55658?
CVE-2024-55658 affects versions up to and including 0.0.0-20241210012039-5129ad926a21 of the Siyuan software.
What type of vulnerability is CVE-2024-55658?
CVE-2024-55658 is a path traversal vulnerability that allows access to arbitrary files on the host system.
Can CVE-2024-55658 be exploited remotely?
Yes, CVE-2024-55658 can be exploited remotely by manipulating the paths parameter in the /api/export/exportResources endpoint.