SiYuan has an arbitrary file write in the host via /api/asset/upload

published 2024-12-11 22 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-3467 , GHSA-fqj6-whhx-47p7 , GO-2024-3326

cvss: 5.4; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 32%
public exploits: 0; none known

SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting (via the file write). Version 3.1.16 contains a patch for the issue.

Patch / fix

fixed in 1 distros 1 links 1

b3log siyuan 3.1.16

govulncheck-vulndb openSUSE Tumbleweed 0.0.20241213T205935-1.1

opensuse advisories openSUSE-SU-2024:14599-1

github.com/siyuan-note/siyuan@e70ed57 commit

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 22 mo ago (2024-12-12)

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CNA	4.0	8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
go	github.com/siyuan-note/siyuan/kernel	<=0.0.0-20241210012039-5129ad926a21 all versions	no fix listed

Affected products

siyuan-note siyuan

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory
CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71
web, patch
github.com /siyuan-note/siyuan/security/advisories/GHSA-fqj6-whhx-47p7
web, vendor-advisory, advisory
nvd.nist.gov /vuln/detail/CVE-2024-55659
advisory
github.com /siyuan-note/siyuan
package
pkg.go.dev /vuln/GO-2024-3326
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary