Description
SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting (via the file write). Version 3.1.16 contains a patch for the issue.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fqj6-whhx-47p7
Scores
CVSS v3
5.4
EPSS
0.0073
EPSS Percentile
72.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-22
CWE-79
Status
published
Products (2)
b3log/siyuan
3.1.15
siyuan-note/siyuan
0Go
Published
Dec 12, 2024
Tracked Since
Feb 18, 2026