Back to Database
Status published
High
CVE-2024-55659
SiYuan has an arbitrary file write in the host via /api/asset/upload
Vulnerability Description
SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting (via the file write). Version 3.1.16 contains a patch for the issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-55659
Credits & Attribution
No credits recorded in the NVD database.
References
More from siyuan-note
View All →CVE-2025-68948
SiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session Secret
Medium
6.9
CVE-2025-67488
SiYuan: ZipSlip -> Arbitrary File Overwrite -> RCE
High
7.8
CVE-2025-21609
SiYuan has an arbitrary file deletion vulnerability
High
8.7
CVE-2024-55660
SiYuan has an SSTI via /api/template/renderSprig
Medium
6.9
CVE-2024-55658
SiYuan has an arbitrary file read and path traversal via /api/export/exportResources
High
8.7
Affected Vendor
siyuan-note
View all reports →Affected Software
siyuan
Vulnerable Versions:
< 3.1.16
Timeline
Official Publish:
December 11th, 2024
Last Modified:
December 12th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
MITRE ATT&CK TTPs
T1190
Exploit Public-Facing Application
Initial Access
T1005
Data from Local System
Collection
T1552
Unsecured Credentials
Credential Access
T1565.001
Stored Data Manipulation
Impact
T1189
Drive-by Compromise
Initial Access
T1059.007
JavaScript
Execution
T1539
Steal Web Session Cookie
Collection
T1213
Data from Information Repositories
Collection
T1567
Exfiltration Over Web Service
Exfiltration
T1491.001
Defacement
Impact