Information Disclosure Vulnerability in SiYuan by SiYuan Note

CVE-2026-72802

What is CVE-2026-72802?

SiYuan versions prior to v3.7.4 are vulnerable to information disclosure through the resolveAssetPath endpoint. This flaw allows unauthorized users to obtain absolute filesystem paths in response to CheckAuth-only requests. By exploiting this vulnerability, attackers can extract relative asset paths from publicly accessible documents and use them to request the absolute workspace path from the server, which in turn reveals sensitive details including the operating system's username and the overall installation structure. This poses significant security risks as it might lead to further exploitation.

References