CVE-2025-21609

Katalog CVE

CVSS 9.1 · Critical EPSS 0,63%

Kerentanan Incomplete Cleanup pada b3log siyuan. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the `POST /api/history/getDocHistoryContent` endpoint. An attacker can craft a payload to exploit this vulnerability, resulting in the deletion of arbitrary files on the server. Commit d9887aeec1b27073bec66299a9a4181dc42969f3 fixes this vulnerability and is expected to be available in version 3.1.19.

Rincian

Terbit di NVD

3 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-459: Incomplete Cleanup
CWE-552: Files or Directories Accessible to External Parties

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8fx8-pffw-w498 exploit · advisory vendor
• https://github.com/siyuan-note/siyuan/commit/d9887aeec1b27073bec66299a9a4181dc42969f3 patch