Some security vulnerabilities

[Elleuch-x1]

Is there an existing issue for this?

• I have searched the existing issues

Can the issue be reproduced with the default theme (daylight/midnight)?

• I was able to reproduce the issue with the default theme

Could the issue be due to extensions?

• I've ruled out the possibility that the extension is causing the problem.

Describe the problem

As requested from the maintainer, here's the titles of the vulnerabilities:

• Arbitrary file read via /api/template/render
• Arbitrary file read via path traversal in /api/export/exportResources
• Stored XSS via /upload
• Stored XSS and arbitrary file write in the host via /api/asset/upload
• Limited SSTI via /api/template/renderSprig

Expected result

n/a

Screenshot or screen recording presentation

No response

Version environment

Latest version

Log file

n/a

More information

The details has been sent to the maintainer

[88250]

Confirmed:

• Arbitrary file read via /api/template/render
• Arbitrary file read via path traversal in /api/export/exportResources
• Stored XSS and arbitrary file write in the host via /api/asset/upload
• SSTI via /api/template/renderSprig

Not considered as vulnerabilities:

• Stored XSS via /upload
  The upload interface can upload any file without checking the file content. If the uploaded file can be opened in SiYuan and causes XSS, please provide more details.