CVE-2026-72802: SiYuan Information Disclosure Vulnerability

CVE-2026-72802 Overview

CVE-2026-72802 is an information disclosure vulnerability in SiYuan, a personal knowledge management application, affecting versions before v3.7.4. The flaw resides in the resolveAssetPath endpoint, which returns absolute filesystem paths without modification to requests that only pass a CheckAuth verification. Attackers can harvest relative asset paths from published documents and submit them to resolveAssetPath to obtain the server's absolute workspace path. The disclosed data includes the operating-system username and full installation layout, providing reconnaissance value for follow-on attacks. The issue is categorized under [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Unauthenticated network attackers can enumerate absolute filesystem paths, disclosing operating-system usernames and installation directory structure for SiYuan workspaces.

Affected Products

SiYuan versions prior to v3.7.4
SiYuan resolveAssetPath endpoint (all deployments)
Published SiYuan documents referencing relative asset paths

Discovery Timeline

2026-08-12 - CVE-2026-72802 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-72802

Vulnerability Analysis

SiYuan exposes an internal API endpoint named resolveAssetPath that translates relative asset references stored in notebooks into absolute filesystem locations. The endpoint enforces only the lightweight CheckAuth middleware rather than a stricter authorization check tied to document ownership. As a result, any actor who can reach the endpoint over the network can convert a known relative path into a fully qualified path on the host.

Attackers first collect relative asset paths from any publicly published SiYuan document. Submitting these paths to resolveAssetPath returns the corresponding absolute path on the server. The response reveals the workspace root, the operating-system username embedded in the home directory, and the layout of installed files.

This information supports subsequent attacks. Adversaries can craft targeted path traversal payloads, tailor privilege escalation techniques to the identified username, and confirm software installation locations before attempting exploitation of other flaws.

Root Cause

The root cause is broken access control on the resolveAssetPath handler. The handler validates that a session token is present but does not verify whether the requester is authorized to resolve the supplied asset reference. It then returns the unmodified absolute path from the server-side lookup, treating filesystem metadata as non-sensitive.

Attack Vector

Exploitation requires network access to the SiYuan HTTP interface and knowledge of at least one relative asset path from a published document. The attacker issues an HTTP request to resolveAssetPath containing the harvested relative path. The server responds with the absolute path, disclosing username and workspace directory structure without requiring authenticated user credentials beyond CheckAuth.

Refer to the GitHub Security Advisory and the VulnCheck Security Advisory for endpoint specifics.

Detection Methods for CVE-2026-72802

Indicators of Compromise

HTTP requests to the /api/asset/resolveAssetPath endpoint originating from unexpected IP ranges or user agents.
Repeated resolveAssetPath calls containing varied relative asset paths harvested from public documents.
Response payloads from SiYuan containing absolute paths that include user home directory components such as /home/<user>/ or C:\Users\<user>\.

Detection Strategies

Enable HTTP access logging on the SiYuan reverse proxy and alert on any traffic to resolveAssetPath from non-internal networks.
Correlate requests to published document URLs with subsequent resolveAssetPath calls that reuse the same asset identifiers.
Baseline normal API usage and flag bursts of resolveAssetPath requests that exceed typical editing workflows.

Monitoring Recommendations

Forward SiYuan application logs and reverse-proxy access logs to a centralized logging platform for retention and analysis.
Monitor for outbound responses containing filesystem path patterns and username strings from the SiYuan host.
Track the SiYuan version deployed across environments to confirm upgrade coverage.

How to Mitigate CVE-2026-72802

Immediate Actions Required

Upgrade SiYuan to version 3.7.4 or later on all hosts.
Restrict network exposure of SiYuan instances to trusted networks or place them behind an authenticating reverse proxy.
Audit historical logs for prior resolveAssetPath requests and treat any absolute paths returned as disclosed.

Patch Information

SiYuan v3.7.4 addresses the information disclosure by hardening the authorization logic on resolveAssetPath. Administrators should upgrade using the official release channel referenced in the GitHub Security Advisory.

Workarounds

Block external access to the resolveAssetPath endpoint at the reverse proxy layer until the upgrade is applied.
Run SiYuan under a dedicated service account whose username does not reveal organizational context.
Avoid publishing SiYuan documents that reference sensitive asset paths while running an unpatched version.

bash

# Example nginx snippet to block the vulnerable endpoint pending upgrade
location = /api/asset/resolveAssetPath {
    deny all;
    return 403;
}