SiYuan 存在一个任意文件读取和路径遍历漏洞，通过 github.com/siyuan-note/siyuan/kernel 中的 /api/export/exportResources

攻击者可以利用此路径遍历漏洞读取SiYuan服务器上的任意文件，包括配置文件、数据库备份、源代码等。如果服务器上存储了敏感信息，例如用户凭据、API密钥或商业机密，攻击者可能会窃取这些信息。此外，攻击者可能利用此漏洞修改或删除文件，从而破坏SiYuan的正常运行。由于SiYuan通常用于存储个人笔记和文档，因此该漏洞可能导致用户隐私泄露和数据丢失。

Users of SiYuan who are running versions prior to 3.1.16 are at risk. This includes individuals using SiYuan for personal note-taking, as well as organizations deploying SiYuan for team collaboration or knowledge management. Shared hosting environments where SiYuan is installed are particularly vulnerable, as a compromise of one user's instance could potentially expose files belonging to other users on the same server.

• linux / server: Monitor access logs for requests to /api/export/exportResources containing path traversal sequences (e.g., ../, ../../).

grep '/api/export/exportResources.*../' /var/log/nginx/access.log

• generic web: Use curl to test the endpoint with various path traversal payloads.

curl 'http://<siyuan_server>/api/export/exportResources?file=../../../../etc/passwd'

• go: Examine the SiYuan Kernel source code for the /api/export/exportResources function and related file handling logic to identify potential vulnerabilities or insecure coding practices.

1. 2024-12-12Disclosure

   disclosure

1. 已保留2024-12-10
2. 发布日期2024-12-12
3. 修改日期2026-03-03
4. EPSS 更新日期2026-04-02

最有效的缓解措施是立即升级至SiYuan 3.1.16版本或更高版本。如果无法立即升级，可以考虑以下临时缓解措施：限制对/api/export/exportResources接口的访问，例如通过Web应用防火墙（WAF）或反向代理服务器进行过滤。此外，应确保SiYuan服务器上的文件权限设置正确，防止未经授权的访问。监控SiYuan服务器的访问日志，及时发现异常活动。