CVE-2025-21609: b3log siyuan Incomplete Cleanup

Vulnerability summary

CVE-2025-21609 is a critical (CVSS 9.1) Incomplete Cleanup vulnerability in b3log siyuan. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 03-01-2025
   PublishedVulnerability first disclosed.
2. 03-01-2025
   Last modifiedVulnerability information updated.

Description

SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the `POST /api/history/getDocHistoryContent` endpoint. An attacker can craft a payload to exploit this vulnerability, resulting in the deletion of arbitrary files on the server. Commit d9887aeec1b27073bec66299a9a4181dc42969f3 fixes this vulnerability and is expected to be available in version 3.1.19.

• CWE-459Incomplete CleanupThe product does not properly "clean up" and remove temporary or supporting resources after they have been used.
• CWE-552Files or Directories Accessible to External PartiesThe product makes files or directories accessible to unauthorized actors, even though they should not be.