CVE-2025-21609 SiYuan has an arbitrary file deletion vulnerability

What is CVE-2025-21609?

CVE-2025-21609 is a high-severity path traversal vulnerability in B3log Siyuan, published on 3 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the `POST /api/history/getDocHistoryContent` endpoint. An attacker can craft a payload to exploit this vulnerability, resulting in the deletion of arbitrary files on the server. Commit d9887aeec1b27073bec66299a9a4181dc42969f3 fixes this vulnerability and is expected to be available in version 3.1.19.

Weakness: CWE-552, CWE-459

Which versions are affected by CVE-2025-21609?

3 open source packages ship an affected version, including github.com/siyuan-note/siyuan/kernel. It affects 1 product.

Products include B3log Siyuan.

How do I fix CVE-2025-21609?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-21609 being exploited?

There is no known exploitation of CVE-2025-21609 in the wild and no public exploit code.

Other vulnerabilities in B3log Siyuan

• CVE-2026-32938 SiYuan has an Arbitrary File Read in its Desktop Publish Service Critical 9.9
• CVE-2026-33669 SiYuan has Arbitrary Document Reading within the Publishing Service Critical 9.8
• CVE-2026-33670 SiYuan has directory traversal within its publishing service Critical 9.8
• CVE-2026-32767 SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API Critical 9.8
• CVE-2024-53504 SQL injection in n/a Critical 9.8

All B3log Siyuan vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8fx8-pffw-w498, GO-2025-3362.