CVE-2026-54066: SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894

The patch for CVE-2026-41894 (“Path Traversal via Double URL Encoding”) sanitized the /export/ route but the identical root cause remains in the /assets/*path route. In publish mode (anonymous read-only HTTP endpoint, default port 6808), an unauthenticated remote attacker can read arbitrary files inside WorkspaceDir — including conf/conf.json (which contains the AccessAuthCode SHA256 hash, API token, and sync keys), temp/siyuan.db, temp/blocktree.db, and siyuan.log — by double-URL-encoding .. segments.

Verified against siyuan v3.6.5:

• GET /assets/%252e%252e/%252e%252e/conf/conf.json → HTTP 200, 10349 bytes (conf.json served)
• GET /export/%252e%252e/%252e%252e/conf/conf.json → HTTP 401 (patched)
• GET /assets/%2e%2e/conf/conf.json → HTTP 404 (single-decode handled correctly)