SiYuan has an arbitrary file write in the host via /api/asset/upload

Description

References

• siyuan-note/siyuan security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2024-55659 · ADVISORY
• siyuan-note/siyuan commit e70ed57 · WEB
• siyuan-note/siyuan · PACKAGE
• pkg.go.dev/vuln/GO-2024-3326 · WEB

Mais vulnerabilidades de github.com/siyuan-note/siyuan/kernel

• GHSA-xp3q-r38w-vgqmMÉDIO 5.8SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized
• CVE-2026-85175ALTO 8.8SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go),…
• CVE-2026-82651MÉDIO 4.9SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*p…
• CVE-2026-82234ALTO 8.2SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform…
• CVE-2026-82233MÉDIO 5.7SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without…