CVE-2026-72802: SiYuan before v3.7.4 Information Disclosure via resolveAssetPath
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that returns absolute filesystem paths unmodified to CheckAuth-only requests. Attackers can harvest relative asset paths from published documents and submit them to resolveAssetPath to obtain the server's absolute workspace path, disclosing the operating-system username and installation layout.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.7.4 - Compensating control
Ensure the resolveAssetPath endpoint does not return absolute filesystem paths to CheckAuth-only requests (only allow full authenticated/authorized requests to receive filesystem paths).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72802?
The severity of CVE-2026-72802 is rated medium with a score of 5.3.
How do I fix CVE-2026-72802?
To fix CVE-2026-72802, upgrade to SiYuan version 3.7.4 or later.
What type of vulnerability is CVE-2026-72802?
CVE-2026-72802 is an information disclosure vulnerability.
Which versions of SiYuan are affected by CVE-2026-72802?
SiYuan versions before 3.7.4 are affected by CVE-2026-72802.
What is the impact of CVE-2026-72802?
The impact of CVE-2026-72802 allows attackers to harvest filesystem paths from published documents.