CVE-2025-21609

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the `POST /api/history/getDocHistoryContent` endpoint. An attacker can craft a payload to exploit this vulnerability, resulting in the deletion of arbitrary files on the server. Commit d9887aeec1b27073bec66299a9a4181dc42969f3 fixes this vulnerability and is expected to be available in version 3.1.19.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-459 CWE-552

Affected software

No affected versions have been published.

Timeline

Published: Jan 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-21616.1Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup CVE-2025-216105.3Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scriptin CVE-2025-216118.8tgstation-server is a production scale tool for BYOND server management. Prior to 6.12.3, roles used to authorize API methods were incorrect CVE-2025-216128.6TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-suppli CVE-2025-216139.8go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git ve CVE-2025-216147.5go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-gi CVE-2025-216155.5AAT (Another Activity Tracker) is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower than CVE-2025-216165.4Plane is an open-source project management tool. A cross-site scripting (XSS) vulnerability has been identified in Plane versions prior to 0 CVE-2025-216176.3Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a crypto CVE-2025-216187.5NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, inclu CVE-2025-216199.8GLPI is a free asset and IT management software package. An administrator user can perfom a SQL injection through the rules configuration fo CVE-2025-21624.8The MapPress Maps for WordPress plugin before 2.94.10 does not sanitise and escape some of its settings, which could allow high privilege us