What is CVE-2024-55658?

CVE-2024-55658 is a high-severity vulnerability in B3log Siyuan, classified under Path Traversal. CVSS score: 7.5/10. Published 2024-12-12.

How severe is CVE-2024-55658?

High severity. CVSS v3 base score is 7.5 out of 10.

Path Traversal in B3log Siyuan

CVE-2024-55658

SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure. Version 3.1.16 contains a patch for the issue.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.006 (45.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

B3log Siyuan — versions 3.1.15
Siyuan-note Siyuan — versions < 3.1.16

Weakness classification (CWE)

CWE-22 — Path Traversal

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2024-55658?: CVE-2024-55658 is a high-severity vulnerability in B3log Siyuan, classified under Path Traversal. CVSS score: 7.5/10. Published 2024-12-12.
How severe is CVE-2024-55658?: High severity. CVSS v3 base score is 7.5 out of 10.