SiYuan Note Arbitrary File Deletion Vulnerability

An arbitrary file deletion vulnerability has been identified in SiYuan Note version 3.1.18. The issue arises in the 'POST /api/history/getDocHistoryContent' endpoint, where an attacker can send a crafted payload to delete arbitrary files on the server. This vulnerability has been patched in version 3.1.19.

Impact

Exploitation of this vulnerability allows for the arbitrary deletion of files on the server.

Reproduction

To reproduce this vulnerability, send a POST request to the '/api/history/getDocHistoryContent' endpoint with a JSON payload containing the 'historyPath' parameter. Replace '<abs_filepath_of_a_file>' with the absolute path of the file intended for deletion. The request can be made using curl.

Remediation

Users can update to SiYuan Note version 3.1.19 to address this vulnerability.