CVE-2026-72796: SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers
Several static-file routes in the server mux (kernel/server/serve.go) are registered with CheckAuth only and serve directories directly, without the publish-access checks, sensitive-path blocklist, or refuseToAccess rules that the REST API applies to the same data. They are therefore reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false.
Most notably, /templates/ serves data/templates a directory the REST file API explicitly refuses to serve to non-administrators.
References
- github.com/advisories/GHSA-fgmr-7w36-9qfq
- github.com/siyuan-note/siyuan/commit/34be6c0bb0739d5b8e99ecc0cbfb474abb16230d
- github.com/siyuan-note/siyuan/security/advisories/GHSA-fgmr-7w36-9qfq
- nvd.nist.gov/vuln/detail/CVE-2026-72796
- www.vulncheck.com/advisories/siyuan-before-access-control-bypass-via-static-routes
Code Behaviors & Features
Detect and mitigate CVE-2026-72796 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →