CVE-2026-72802: SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath
POST /api/asset/resolveAssetPath returns the resolved absolute filesystem path of an asset, unmodified. The route is CheckAuth-only, so it is reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false. An anonymous reader who knows any asset’s relative path trivially harvested from an <img src="assets/…"> in any published document receives the server’s absolute workspace path, disclosing the operating-system username and the installation layout.
References
- github.com/advisories/GHSA-jv8v-xq2h-657v
- github.com/siyuan-note/siyuan/commit/eee3410aa131b76f1bd72e933d484cf1ece77e88
- github.com/siyuan-note/siyuan/security/advisories/GHSA-jv8v-xq2h-657v
- nvd.nist.gov/vuln/detail/CVE-2026-72802
- www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-resolveassetpath
Code Behaviors & Features
Detect and mitigate CVE-2026-72802 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →