What is CVE-2025-21609?

CVE-2025-21609 is a critical-severity vulnerability in B3log Siyuan, classified under Incomplete Cleanup. CVSS score: 9.1/10. Published 2025-01-03.

How severe is CVE-2025-21609?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Vulnerability in B3log Siyuan

CVE-2025-21609

SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the `POST /api/history/getDocHistoryContent` endpoint. An attacker can craft a payload to exploit this vulnerability, resulting in the deletion of arbitrary files on the server. Commit d9887aeec1b27073bec66299a9a4181dc42969f3 fixes this vulnerability and is expected to be available in version 3.1.19.

Published 2025-01-03 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

EPSS exploit prediction

EPSS: 0.006 (46.6th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 47th percentile — 46.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000

Affected products

B3log Siyuan — versions 3.1.18
Siyuan-Note Siyuan — versions = 3.1.18

Weakness classification (CWE)

References

github.com/siyuan-note/siyuan/security/advisories/GHSA-8fx8-pffw-w498 (Exploit, Vendor Advisory)
github.com/siyuan-note/siyuan/commit/d9887aeec1b27073bec66299a9a4181dc42969f3 (Patch)

Frequently asked questions

What is CVE-2025-21609?: CVE-2025-21609 is a critical-severity vulnerability in B3log Siyuan, classified under Incomplete Cleanup. CVSS score: 9.1/10. Published 2025-01-03.
How severe is CVE-2025-21609?: Critical severity. CVSS v3 base score is 9.1 out of 10.