CVE-2025-21609 - CVE House

Back to Database

Status published High CVE-2025-21609

SiYuan has an arbitrary file deletion vulnerability

8.7 CVSS

Vulnerability Description

SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the `POST /api/history/getDocHistoryContent` endpoint. An attacker can craft a payload to exploit this vulnerability, resulting in the deletion of arbitrary files on the server. Commit d9887aeec1b27073bec66299a9a4181dc42969f3 fixes this vulnerability and is expected to be available in version 3.1.19.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-21609

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from siyuan-note

View All →

SiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session Secret

SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE

SiYuan has an SSTI via /api/template/renderSprig

SiYuan has an arbitrary file write in the host via /api/asset/upload

SiYuan has an arbitrary file read and path traversal via /api/export/exportResources

Affected Vendor

siyuan-note

View all reports →

Affected Software

siyuan

Vulnerable Versions:

= 3.1.18

Timeline

Official Publish: January 3rd, 2025

Last Modified: January 3rd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-459 CWE-552

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1083 File and Directory Discovery

T1005 Data from Local System

T1041 Exfiltration Over C2 Channel

T1565 Data Manipulation