What is GHSA-fqj6-whhx-47p7?

GHSA-fqj6-whhx-47p7 is a security advisory published by GitHub Security Advisories with High severity. SiYuan has an arbitrary file write in the host via /api/asset/upload

Which CVE IDs does GHSA-fqj6-whhx-47p7 cover?

GHSA-fqj6-whhx-47p7 covers the following CVE IDs: CVE-2024-55659. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-fqj6-whhx-47p7?

GHSA-fqj6-whhx-47p7 affects 1 product, including: go/github.com/siyuan-note/siyuan/kernel:\u003c= 0.0.0-20241210012039-5129ad926a21.

GHSA-fqj6-whhx-47p7High

SiYuan has an arbitrary file write in the host via /api/asset/upload

Vendor

GitHub Security Advisories

Published

December 11, 2024

Last Modified

December 12, 2024

🔗 CVE IDs covered (1)

CVE-2024-55659 →

📋 Description

Summary

The /api/asset/upload endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored XSS (via the file write).

Impact

Arbitrary file write

🎯 Affected products1

go/github.com/siyuan-note/siyuan/kernel:<= 0.0.0-20241210012039-5129ad926a21

🔗 References (5)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fqj6-whhx-47p7
https://github.com/siyuan-note/siyuan/commit/e70ed57f6e4852e2bd702671aeb8eb3a47a36d71
https://nvd.nist.gov/vuln/detail/CVE-2024-55659
https://pkg.go.dev/vuln/GO-2024-3326
https://github.com/advisories/GHSA-fqj6-whhx-47p7