CVE-2025-21609 is a critical arbitrary file deletion flaw (CVSS 9.1) in SiYuan Note 3.1.18, the self hosted knowledge management app. The POST /api/history/getDocHistoryContent endpoint can be made to delete files on the server. The fix is in version 3.1.19; update and keep the API private.
What's affected
- Product: SiYuan (b3log siyuan), self hosted personal knowledge management software
- Affected version: 3.1.18, as stated in the record
- Fixed version: 3.1.19, according to the record, which says the fix commit is expected in that release
- Vulnerable endpoint:
POST /api/history/getDocHistoryContent - CVSS: 9.1 (Critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Published: 2025-01-03
The GitHub advisory rates the issue High, while NVD scores it 9.1 Critical. The CISA Known Exploited Vulnerabilities flag is false for this CVE, and none of the pages I read report active exploitation. The advisory credits a researcher and describes a path parameter that is handled without enough checks.
How to check if you're exposed
Find the version first.
# Docker
docker ps --format '{{.Image}} {{.Names}}' | grep -i siyuan
docker image ls | grep -i siyuan
# Desktop or server install: check Settings > About in the app,
# or the version of the binary you run
If you run the container image, the tag tells you the version, but latest hides it, so check the About screen inside the app. Anything at 3.1.18 is affected, and the record gives no earlier versions either way, so treat older releases as unconfirmed and update.
Then check whether the API port, 6806 by default, is reachable from anything other than your own machine. A knowledge base that is open to a shared network or the internet needs an access code and a reverse proxy at the very least. You can also feed an SBOM or manifest into our free in-browser dependency scan to track this CVE across the projects you maintain.
What to do now
- Update SiYuan to 3.1.19 or later. For Docker, pull a pinned newer tag rather than relying on
latest. - Check that the access authorization code is set, and that the service is not reachable from the internet without a reverse proxy and authentication.
- Take a backup of your workspace and data folders, and confirm the backup is stored somewhere the app cannot delete.
- Run the service as an unprivileged user with access only to its own data folder, so a delete bug cannot reach the system.
- Review the host for missing or changed files if the service was exposed while on 3.1.18.
Why it matters
The record lists CWE-552, files or directories accessible to external parties, and CWE-459, incomplete cleanup. In practice the endpoint takes a file path from the request and acts on it without confirming that the path is where it should be. That lets a caller point the delete at a file outside the data it was meant to manage.
Deleting arbitrary files is a serious integrity and availability problem even without code execution. It can remove configuration, logs or data, and on some systems deleting the right file changes what runs at startup. The vector rates integrity and availability high and confidentiality none. The strongest protection is to keep self hosted tools off untrusted networks and run them with a narrow set of file permissions.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
Version 3.1.19, according to the record, which names the fix commit and says it is expected in that release.
Does it need a login?
The vector lists no privileges required. Setting an access code and keeping the service private reduces exposure, but update anyway.
Sources
Last reviewed: 19 October 2026.
