SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting (via the file write). Version 3.1.16 contains a patch for the issue.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| github.com/siyuan-note/siyuan/kernel(Go) | 0 | N/A | N/A |
CVSS Metrics
