← Database

CVE-2024-55659

MEDIUM CVSS: 5.4 Published: 2024-12-12 Modified: 2026-06-17

Description

SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting (via the file write). Version 3.1.16 contains a patch for the issue.

Affected Platforms

B3Log Siyuan

Weakness Type

CWE-22, CWE-79

References