CVE-2026-72799: Missing Authorization in SiYuan Filetree Path-Resolution API
Vulnerability ID: CVE-2026-72799
CVSS Score: 6.9
Published: 2026-09-04
SiYuan before v3.7.4 fails to enforce publish-access filters on five filetree path-resolution endpoints, allowing unauthenticated attackers to reconstruct private directory layouts and map document structures.
TL;DR
Unauthenticated remote attackers can query specific path-resolution APIs in SiYuan to discover the structures, names, and IDs of private, hidden, or password-protected documents when deployed in public publish mode.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-862
- Attack Vector: Network
- CVSS v4.0: 6.9
- EPSS Score: 0.00237 (Percentile: 14.53%)
- Impact: Information Disclosure / Metadata Leakage
- Exploit Status: Proof-of-Concept / Patch-based Analysis
- KEV Status: Not Listed
Affected Systems
- SiYuan Personal Knowledge Management System
-
SiYuan: < v3.7.4 (Fixed in:
v3.7.4)
Code Analysis
Commit: 5bae092
Fix: enforce publish-access filters on filetree path-resolution endpoints
Exploit Details
- GitHub Security Advisory: Description of the affected endpoints and vulnerable configurations.
Mitigation Strategies
- Upgrade SiYuan to version v3.7.4 or higher.
- Enable Publish Authentication by setting Publish.Auth.Enable to true.
- Restrict access to /api/filetree/ endpoints using a reverse proxy.
Remediation Steps:
- Identify self-hosted SiYuan installations and check current version numbers.
- Update the application deployment using the official Docker image or binary to v3.7.4.
- Verify the updated installation by attempting to query /api/filetree/getHPathByID without an active authorization token.
References
Read the full report for CVE-2026-72799 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)