https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T12:46:10.414173+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-207001 EUVD-2026-207001 2026-10-03T12:46:10.462788+00:00 EUVD-2026-207001 https://cve.radiocsirt.org/vuln/fkie_cve-2024-55659 fkie_cve-2024-55659 2026-10-03T12:46:10.462826+00:00

SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting (via the file write). Version 3.1.16 contains a patch for the issue.

 https://cve.radiocsirt.org/vuln/ghsa-fqj6-whhx-47p7 GHSA-fqj6-whhx-47p7 — SiYuan has an arbitrary file write in the host via /api/asset/upload 2026-10-03T12:46:10.462877+00:00

Affected: Go: github.com/siyuan-note/siyuan/kernel

### Summary

The /api/asset/upload endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored XSS (via the file write).

### Impact Arbitrary file write

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14599-1 openSUSE-SU-2024:14599-1 — govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media 2026-10-03T12:46:10.462905+00:00

govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media