Back to Database
Status published
High
CVE-2024-55657
SiYuan has an arbitrary file read via /api/template/render
Vulnerability Description
SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's `/api/template/render` endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. Version 3.1.16 contains a patch for the issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-55657
Credits & Attribution
No credits recorded in the NVD database.
References
More from siyuan-note
View All →CVE-2025-68948
SiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session Secret
Medium
6.9
CVE-2025-67488
SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE
High
7.8
CVE-2025-21609
SiYuan has an arbitrary file deletion vulnerability
High
8.7
CVE-2024-55660
SiYuan has an SSTI via /api/template/renderSprig
Medium
6.9
CVE-2024-55659
SiYuan has an arbitrary file write in the host via /api/asset/upload
High
8.7
Affected Vendor
siyuan-note
View all reports →Affected Software
siyuan
Vulnerable Versions:
< 3.1.16
Timeline
Official Publish:
December 11th, 2024
Last Modified:
December 12th, 2024
Added to House:
July 22nd, 2026