DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-72802: CVE-2026-72802: Sensitive Information Disclosure via Administrative Asset Resolvers in SiYuan Note

#security #cve #cybersecurity

CVE-2026-72802: Sensitive Information Disclosure via Administrative Asset Resolvers in SiYuan Note

Vulnerability ID: CVE-2026-72802
CVSS Score: 6.9
Published: 2026-09-03

SiYuan Note versions prior to v3.7.4 contain an information disclosure vulnerability in the /api/asset/resolveAssetPath endpoint. This endpoint returns absolute backend filesystem paths unmodified to CheckAuth-only requests. Low-privileged users or unauthenticated readers under publish mode can exploit this to leak the local directory layout, operating system username, and overall host deployment structure.

TL;DR

An authorization bypass through user-controlled keys in SiYuan Note allows unauthenticated readers to extract absolute local filesystem paths, exposing host usernames and operating system layout information.

Technical Details

  • CWE ID: CWE-639
  • Attack Vector: Network
  • CVSS v4.0 Score: 6.9 (Medium)
  • CVSS v3.1 Score: 5.3 (Medium)
  • Exploit Status: None
  • CISA KEV Status: Not Listed

Affected Systems

  • SiYuan Note
  • SiYuan: < 3.7.4 (Fixed in: v3.7.4)

Code Analysis

Commit: eee3410

Restrict sensitive asset APIs to administrators

diff --git a/kernel/api/router.go b/kernel/api/router.go
index 23d57f1..7861bc9 100
--- a/kernel/api/router.go
+++ b/kernel/api/router.go
@@ -342,12 +342,12 @@ func ServeAPI(ginServer *gin.Engine) {
    ginServer.Handle("POST", "/api/asset/uploadCloudByAssetsPaths", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, uploadCloudByAssetsPaths)
    ginServer.Handle("POST", "/api/asset/insertLocalAssets", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, insertLocalAssets)
    ginServer.Handle("POST", "/api/asset/insertCover", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, insertCover)
-   ginServer.Handle("POST", "/api/asset/resolveAssetPath", model.CheckAuth, resolveAssetPath)
+   ginServer.Handle("POST", "/api/asset/resolveAssetPath", model.CheckAuth, model.CheckAdminRole, resolveAssetPath)
    ginServer.Handle("POST", "/api/asset/upload", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, model.Upload)
    ginServer.Handle("POST", "/api/asset/setFileAnnotation", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, setFileAnnotation)
    ginServer.Handle("POST", "/api/asset/getFileAnnotation", model.CheckAuth, getFileAnnotation)
-   ginServer.Handle("POST", "/api/asset/getUnusedAssets", model.CheckAuth, getUnusedAssets)
-   ginServer.Handle("POST", "/api/asset/getMissingAssets", model.CheckAuth, getMissingAssets)
+   ginServer.Handle("POST", "/api/asset/getUnusedAssets", model.CheckAuth, model.CheckAdminRole, getUnusedAssets)
+   ginServer.Handle("POST", "/api/asset/getMissingAssets", model.CheckAuth, model.CheckAdminRole, getMissingAssets)
    ginServer.Handle("POST", "/api/asset/removeUnusedAsset", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, removeUnusedAsset)
    ginServer.Handle("POST", "/api/asset/removeUnusedAssets", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, removeUnusedAssets)
    ginServer.Handle("POST", "/api/asset/getDocImageAssets", model.CheckAuth, getDocImageAssets)
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade SiYuan Note to version v3.7.4 or newer.
  • Incorporate Nginx or reverse proxy rules to block external access to administrative asset endpoints.
  • Temporarily disable publish mode to restrict anonymous read access.

Remediation Steps:

  1. Identify the version of the currently running SiYuan Note instance.
  2. Download the v3.7.4 (or later) update package from the official repository.
  3. Stop the running container or application service.
  4. Deploy the updated binaries or pull the updated Docker image.
  5. Restart the SiYuan Note service.
  6. Validate the fix by sending a test POST request to /api/asset/resolveAssetPath using a low-privileged session and verify that the server returns an HTTP 403 Forbidden status.

References

Read the full report for CVE-2026-72802 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)