CVE-2024-55659: SiYuan has an arbitrary file write in the host via /api/asset/upload
Summary
The /api/asset/upload endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored XSS (via the file write).
Impact Arbitrary file write
Other sources
SiYuan is a personal knowledge management system. Prior to version 3.1.16, the /api/asset/upload endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting (via the file write). Version 3.1.16 contains a patch for the issue.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55659?
CVE-2024-55659 has a high severity due to its potential for arbitrary file write and stored XSS vulnerabilities.
How do I fix CVE-2024-55659?
To fix CVE-2024-55659, upgrade to Siyuan version 3.1.16 or later which addresses the vulnerability.
What actions can an attacker perform due to CVE-2024-55659?
An attacker can exploit CVE-2024-55659 to write arbitrary files on the host and potentially execute stored XSS attacks.
Is CVE-2024-55659 present in earlier versions of Siyuan?
Yes, CVE-2024-55659 is present in Siyuan versions prior to 3.1.16.
What is the affected API endpoint in CVE-2024-55659?
The affected API endpoint in CVE-2024-55659 is /api/asset/upload.