Package	Affected Versions	Patched Versions	Severity
📦 github.com/siyuan-note/siyuan/kernel (Go)	< 0.0.0-20250103014808-d9887aeec1b2	–	High

Summary

Siyuan Note contains an arbitrary file deletion vulnerability in the /api/history/getDocHistoryContent endpoint. An attacker can exploit this flaw by crafting a malicious request, which could delete arbitrary files on the server.

---

Technical Details

The vulnerability lies in how the historyPath parameter is processed in the following function chain:

1. api/history.go:133 – Processes historyPath from the request payload.


2. model/history.go:150 – Passes historyPath to the GetDocHistoryContent function.

Here’s the critical section:

If ParseJSONWithoutFix fails, the file at historyPath will be deleted via os.RemoveAll.

Proof of Concept (PoC)

An attacker can exploit this with the following curl command:

Replace <abs_filepath_of_a_file> with the absolute path of the target file.

---

Impact

Successful exploitation allows an attacker to delete any file on the server, potentially leading to service disruption or further exploitation depending on the deleted files.

Mitigation and Fix

Currently, no official patch is available. However, here are some immediate steps to reduce risk:

1. Restrict Access: Limit access to the vulnerable API endpoint to trusted IP addresses.


2. Validate Input: Ensure historyPath strictly validates file paths before processing.


3. Temporary Disablement: If possible, disable the /api/history/getDocHistoryContent endpoint until a patch is released.

---

Recommended Code Fix Example:
Add strict validation to prevent arbitrary file paths:

Implement isValidHistoryPath to ensure historyPath adheres to safe patterns.