GCVE - cpe:2.3:a:b3log:siyuan:3.1.15:-:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:b3log:siyuan:3.1.15:-:*:*:*:*:*:*

part: a version: 3.1.15 update: -

Vendor	B3Log (`86d16015-6676-51cc-958c-521884a67196`)
Product	Siyuan (`173c2db0-bf9a-50e3-b833-47ab1492d21c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:gitee/siyuan-note/siyuan`	purl2cpe	2026-06-01 10:11:23.667009
`pkg:github/siyuan-note/siyuan`	purl2cpe	2026-06-01 10:11:23.667010

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-55660`	vulnerable	2026-06-08 06:54:17.167322	SiYuan has an SSTI via /api/template/renderSprig SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's `/api/template/renderSprig` endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows attackers to access environment variables. Version 3.1.16 contains a patch for the issue. Published: 2024-12-11T22:54:52.564Z Updated: 2024-12-12T16:29:14.433Z Open on db.gcve.eu Reference links https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4pjc-pwgq-q9jp https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-55659`	vulnerable	2026-06-08 06:54:17.166850	SiYuan has an arbitrary file write in the host via /api/asset/upload SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting (via the file write). Version 3.1.16 contains a patch for the issue. Published: 2024-12-11T22:53:45.983Z Updated: 2024-12-12T16:29:46.007Z Open on db.gcve.eu Reference links https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fqj6-whhx-47p7 https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-55658`	vulnerable	2026-06-08 06:54:17.166338	SiYuan has an arbitrary file read and path traversal via /api/export/exportResources SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace directory structure. Version 3.1.16 contains a patch for the issue. Published: 2024-12-11T22:47:21.809Z Updated: 2024-12-12T16:30:20.341Z Open on db.gcve.eu Reference links https://github.com/siyuan-note/siyuan/security/advisories/GHSA-25w9-wqfq-gwqx https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-55657`	vulnerable	2026-06-08 06:54:17.165703	SiYuan has an arbitrary file read via /api/template/render SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's `/api/template/render` endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. Version 3.1.16 contains a patch for the issue. Published: 2024-12-11T22:44:17.868Z Updated: 2024-12-12T16:30:52.826Z Open on db.gcve.eu Reference links https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xx68-37v4-4596 https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.