CVE-2026-72802: SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath
POST /api/asset/resolveAssetPath returns the resolved absolute filesystem path of an asset, unmodified. The route is CheckAuth-only, so it is reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false. An anonymous reader who knows any asset’s relative path trivially harvested from an <img src="assets/…"> in any published document receives the server’s absolute workspace path, disclosing the operating-system username and the installation layout.
References
- github.com/advisories/GHSA-jv8v-xq2h-657v
- github.com/siyuan-note/siyuan/commit/eee3410aa131b76f1bd72e933d484cf1ece77e88
- github.com/siyuan-note/siyuan/security/advisories/GHSA-jv8v-xq2h-657v
- nvd.nist.gov/vuln/detail/CVE-2026-72802
- www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-resolveassetpath
Code Behaviors & Features
Detect and mitigate CVE-2026-72802 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →