medium5.3
CVE-2026-72802
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that returns absolute filesystem paths unmodifie…
Impact
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that returns absolute filesystem paths unmodified to CheckAuth-only requests. Attackers can harvest relative asset paths from published documents and submit them to resolveAssetPath to obtain the server's absolute workspace path, disclosing the operating-system username and installation layout.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/siyuan-note/siyuan/kernel | < 0.0.0-20260724095509-eee3410aa131 | 0.0.0-20260724095509-eee3410aa131 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-jv8v-xq2h-657v
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jv8v-xq2h-657v
- https://nvd.nist.gov/vuln/detail/CVE-2026-72802
- https://github.com/siyuan-note/siyuan/commit/eee3410aa131b76f1bd72e933d484cf1ece77e88
- https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-resolveassetpath