Описание
SiYuan has an SSTI via /api/template/renderSprig
Summary
Siyuan's /api/template/renderSprig endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows attackers to access environment variables
Impact
Information leakage
Пакеты
Наименование
github.com/siyuan-note/siyuan/kernel
go
Затронутые версииВерсия исправления
<= 0.0.0-20241210012039-5129ad926a21
Отсутствует
Связанные уязвимости
CVSS3: 9.8
nvd
около 1 года назад
SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's `/api/template/renderSprig` endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows attackers to access environment variables. Version 3.1.16 contains a patch for the issue.