GHSA-fgmr-7w36-9qfq: Medium severity go/github.com/siyuan-note/siyuan/kernel vulnerability
CVE: This vulnerability corresponds to CVE-2026-72796.
Summary
Several static-file routes in the server mux (kernel/server/serve.go) are registered with CheckAuth only and serve directories directly, without the publish-access checks, sensitive-path blocklist, or refuseToAccess rules that the REST API applies to the same data. They are therefore reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false.
Most notably, /templates/ serves data/templates a directory the REST file API explicitly refuses to serve to non-administrators.
Details
| Route | Registration | Guard | Exposed to a reader | |---|---|---|---| | /templates/ (line 424) | Group("/templates/", model.CheckAuth).Static("", data/templates) | none beyond path cleaning | the templates directory | | /snippets/ (line 434) | CheckAuth | blocks only conf.json | any snippet's JS/CSS content by name | | /widgets/, /plugins/, /emojis/ (409/414/419) | Group(CheckAuth).Static(dir) | none | whole directory trees | | /export/ (line 320) | Group("/export/", CheckAuth) | traversal, sensitive-path and DEK guards: no publish check | export artifacts (PDF/HTML/DOCX/CSV) |
/templates/ directly contradicts an existing control. The REST file path runs refuseToAccess (kernel/api/file.go:551-553), which explicitly returns 403 for data/templates/ to non-administrators the project has already decided readers must not read templates. The /templates/ static route serves that same directory to any RoleReader, with no IsSensitivePath check, no publish-access check, and no refuseToAccess. Templates are user-authored Markdown documents containing template/Sprig syntax and are not covered by publish-access controls. gin's .Static disables directory listing, so a filename is required but the contradiction with refuseToAccess is the defect.
/export/ versus /assets/. /assets/path (line 692) correctly gates non-administrators via CheckAbsPathAccessableByPublishAccess, plus IsSensitivePath and encrypted-asset handling. /export/ carries traversal, sensitive-path and DEK guards but no publish-access check, so a reader can retrieve export artifacts of arbitrary documents, including private ones. Artifact naming is mixed, some use a random export ID, but code and CSV exports use the document name (export/code/<name>, export/csv/<name>/<name>.csv), which a reader can derive from listDocsByPath titles while the artifact exists. This path is therefore conditional.
Confirmed correctly gated, for contrast: /assets/ (publish-gated), /history/ and /repo/diff/ (CheckAdminRole), /debug/pprof/ (disabled in production builds), /public/ (intentionally public).
All four routes above were verified to carry CheckAuth only, no CheckReadonly, no CheckAdminRole.
Proof of Concept
Precondition: publish mode enabled (default port 6808), anonymous when Publish.Auth.Enable is false, otherwise any publish reader account.
Templates: served despite the REST API refusing them: GET http://127.0.0.1:6808/templates/<template-file>.md → 200, template content The equivalent REST request is refused: POST http://127.0.0.1:6808/api/file/getFile {"path":"data/templates/<template-file>.md"} → 403 (refuseToAccess) The same reader session obtains the file through the static route.
Snippets: GET http://127.0.0.1:6808/snippets/<snippet-name>.js → 200, snippet source
Export artifacts (conditional on a predictable name while the artifact exists): GET http://127.0.0.1:6808/export/csv/<doc-name>/<doc-name>.csv → 200, exported content of a document the reader has no publish access to
Impact
An anonymous reader (publish mode with auth disabled) or any publish RoleReader can read user-authored template documents that the REST API explicitly withholds from non-administrators, snippet source (JS/CSS), and the contents of the widgets, plugins and emoji directories. Where an export artifact exists under a derivable name, they can additionally retrieve exported content of documents outside their publish scope. Confidentiality-only.
Suggested fix
Apply the same treatment these routes' REST counterparts already receive: for non-administrator roles, enforce publish-access scoping plus IsSensitivePath and the refuseToAccess blocklist on the static routes, mirroring /assets/. Alternatively, block /templates/, non-public /snippets/, and /export/ for reader roles entirely.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/siyuan-note/siyuan/kernelto a version that resolves this vulnerability.Fixed in 0.0.0-20260725122641-34be6c0bb073 - Configuration
Update the static-file route handlers/guards in kernel/server/serve.go so that for non-administrator roles the static routes mirror the REST API protections already applied to the equivalent data (publish-access scoping plus IsSensitivePath filtering and the refuseToAccess blocklist on the static routes). This specifically fixes routes registered with only CheckAuth, including: /export/* (line 320), /templates/* (line 424), /snippets/* (line 434), and the directory trees /widgets/, /plugins/, /emojis/. Ensure /templates/ uses the same deny behavior as REST refusesToAccess for data/templates/.
Web server static routes (kernel/server/serve.go) authorization/publish-access enforcement for static routes = Enforce publish-access scoping plus IsSensitivePath checks and the refuseToAccess blocklist on /export/, /snippets/, /templates/, /widgets/, /plugins/, /emojis (static-file routes currently registered with CheckAuth only) - Configuration
Modify the /templates/ static route (Group("/templates/", model.CheckAuth).Static("", data/templates), line 424) to apply the same refuseToAccess behavior as the REST file API (kernel/api/file.go:551-553) so that non-administrator roles get 403 for data/templates/ (instead of serving templates directly).
Web server static route /templates/ refuseToAccess behavior for data/templates = Apply refuseToAccess blocklist for data/templates/ to non-admin roles (return 403) - Configuration
Add the missing publish-access check to the /export/ static route (Group("/export/", CheckAuth), line 320). The material states /export/ currently has traversal/sensitive-path/DEK guards but no publish check; enforce publish-access scoping so readers cannot download export artifacts (PDF/HTML/DOCX/CSV) for documents outside their publish scope.
Web server static routes /export/ and export artifacts publish-access check for /export/ = Add publish-access check (currently only CheckAuth) while keeping traversal, sensitive-path and DEK guards - Compensating control
Temporarily block access to the static endpoints for reader roles by denying these routes at the front-end/WAF/ingress: /templates/, non-public /snippets/, and /export/ (for non-administrator roles), as an alternative to immediate code-level guard parity with the REST endpoints.
Event History
Frequently Asked Questions
Can this be exploited without credentials?
Yes, when Publish.Auth.Enable is false, the affected static-file routes are reachable through the anonymous account. When publish authentication is enabled, a publish RoleReader token can access them.
What data can a publish RoleReader access through these routes?
A reader can access the data/templates directory through /templates/, including content that the REST file API refuses to serve to non-administrators. Reader access also exposes snippet JavaScript and CSS by name, as well as the directory trees served through /widgets/, /plugins/, and /emojis/.
Do the affected static routes enforce the same restrictions as the REST file API?
No. These routes use CheckAuth but do not apply the REST API's publish-access checks, sensitive-path blocklist, or refuseToAccess rules. The /snippets/ route only blocks conf.json.