Description
SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SiYuan | SiYuan | 3.0.3 | — |
Critical · 9.0
CVE-2024-2692
EUVD-2024-27638GHSA-pgf5-9895-3ph9
SiYuan 3.0.3 - RCE via Server Side XSS
Published Apr 4, 2024 · Updated May 19, 2025 · Assigned by Fluid Attacks