CVE-2024-55659: SiYuan has an arbitrary file write in the host via /api/asset/upload

December 11, 2024 (updated October 31, 2025)

The /api/asset/upload endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored XSS (via the file write).

References

github.com/advisories/GHSA-fqj6-whhx-47p7
github.com/siyuan-note/siyuan
github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71
github.com/siyuan-note/siyuan/security/advisories/GHSA-fqj6-whhx-47p7
nvd.nist.gov/vuln/detail/CVE-2024-55659
pkg.go.dev/vuln/GO-2024-3326

Code Behaviors & Features

Detect and mitigate CVE-2024-55659 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →