~ / search / GHSA-xx68-37v4-4596

GHSA-xx68-37v4-4596

SiYuan has an arbitrary file read via /api/template/render

Source: GitHub Advisory Database (reviewed) High CVE-2024-55657

Packages

EcosystemPackageAffectedFixed in
Go github.com/siyuan-note/siyuan/kernel <= 0.0.0-20241210012039-5129ad926a21 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary An arbitrary file read vulnerability exists in Siyuan's /api/template/render endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. ### Impact Arbitrary file read on the host

References

External links from the advisory. They lead to third-party sites.