{"id":"CVE-2026-72802","revision":null,"records":[{"revision":"6fb09f53389142569c1bc61671287d79","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-72802","aliases":[],"title":"SiYuan before v3.7.4 Information Disclosure via resolveAssetPath","description":"SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that returns absolute filesystem paths unmodified to CheckAuth-only requests. Attackers can harvest relative asset paths from published documents and submit them to resolveAssetPath to obtain the server's absolute workspace path, disclosing the operating-system username and installation layout.","state":0,"publishedAt":"2026-08-12T19:07:47.728+00:00","modifiedAt":"2026-08-14T16:52:08.869+00:00","affected":[{"ecosystem":"Vendor product","name":"siyuan","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"siyuan-note\",\n                    \"product\": \"siyuan\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/siyuan-note/siyuan/kernel\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.7.4\"\n                        },\n                        {\n                            \"version\": \"3.7.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jv8v-xq2h-657v","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-resolveassetpath"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72802","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-72802","identifiers":["CVE-2026-72802"]},"retained":false,"historicalAffected":[]},{"revision":"fc266a146ce541c5a4e2cbee3c34dc17","observedAt":"2026-10-25T15:19:03.401+00:00","statement":{"source":"nvd","id":"CVE-2026-72802","aliases":[],"title":"SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that returns absolute filesystem paths unmodified to CheckAuth-only requests. Attackers can harvest relative asset paths from pub…","description":"SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that returns absolute filesystem paths unmodified to CheckAuth-only requests. Attackers can harvest relative asset paths from published documents and submit them to resolveAssetPath to obtain the server's absolute workspace path, disclosing the operating-system username and installation layout.","state":0,"publishedAt":"2026-08-12T20:17:52.11+00:00","modifiedAt":"2026-10-24T15:10:00.19+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jv8v-xq2h-657v","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-resolveassetpath"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72802","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-639"],"productCriteria":[],"sourceDates":{"published":"2026-08-12T20:17:52.110","lastModified":"2026-10-24T15:10:00.190"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-72802","identifiers":["CVE-2026-72802"]},"retained":false,"historicalAffected":[]},{"revision":"1847f61fe9d441c388d0220e890ca18f","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-jv8v-xq2h-657v","aliases":["CVE-2026-72802","GO-2026-6398"],"title":"SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath","description":"**CVE:** This vulnerability corresponds to [CVE-2026-72802](https://nvd.nist.gov/vuln/detail/CVE-2026-72802).\n\n### Summary\n\n`POST /api/asset/resolveAssetPath` returns the resolved **absolute** filesystem path of an asset, unmodified. The route is `CheckAuth`-only, so it is reachable by the publish `RoleReader` token and by the anonymous account when `Publish.Auth.Enable` is `false`. An anonymous reader who knows any asset's relative path trivially harvested from an `<img src=\"assets/…\">` in any published document receives the server's absolute workspace path, disclosing the operating-system username and the installation layout.\n\n### Details\n\n```go\n// kernel/api/asset.go: resolveAssetPath\np, err := model.GetAssetAbsPathInBox(path, \"\")   // boxID=\"\" → absolute workspace path\n...\nret.Data = p                                     // returned raw, no stripping\n```\n\n`GetAssetAbsPathInBox(path, \"\")` resolves under `util.DataDir` / `util.WorkspaceDir`, producing a full host path such as `C:\\Users\\<username>\\SiYuan\\data\\assets\\foo.png` or `/home/<user>/…`. The handler returns it directly with no redaction and no publish-scope check.\n\n**This is data the project already treats as sensitive.** `getConf` explicitly zeroes `System.WorkspaceDir`, `AppDir`, `ConfDir`, `DataDir`, and `HomeDir` when `util.IsBrowserRequest(c)`, a change made specifically to avoid leaking the username (issue #17410). `resolveAssetPath` performs no equivalent stripping, so it re-exposes precisely the values `getConf` was patched to hide.\n\n**Related unfiltered siblings** in the same file, also `CheckAuth`-only with no publish scoping:\n- `getMissingAssets`: workspace-wide list of missing asset references\n- `getUnusedAssets`: every unused asset filename in the assets directory\n\nBoth return asset inventory spanning all documents, including publish-forbidden ones.\n\nVerified at `origin/master`: `resolveAssetPath` returns the absolute path with no redaction, `getConf` contains the `IsBrowserRequest` stripping; all three routes are registered `CheckAuth` without `CheckAdminRole`.\n\n### Proof of Concept\n\nPrecondition: publish mode enabled (default port 6808); anonymous when `Publish.Auth.Enable` is `false`, otherwise any publish reader account.\n\n**1. Harvest an asset path**: open any published document and read a relative asset path from its markup, e.g. `assets/foo-20260101120000-abcdefg.png`.\n\n**2. Resolve it as an anonymous reader:**\n```\nPOST http://127.0.0.1:6808/api/asset/resolveAssetPath\n{\"path\":\"assets/foo-20260101120000-abcdefg.png\"}\n```\n\n**3. Result:** the response returns the absolute host path, e.g.\n`C:\\Users\\<username>\\SiYuan\\data\\assets\\foo-...png` disclosing the OS username and the full workspace/installation layout.\n\n**Control:** `getConf` from the same anonymous session returns `WorkspaceDir`/`DataDir`/`HomeDir` blanked, confirming the project intends these values to be withheld from browser requests.\n\n**Related:**\n```\nPOST http://127.0.0.1:6808/api/asset/getUnusedAssets   {}\nPOST http://127.0.0.1:6808/api/asset/getMissingAssets  {}\n```\nReturn workspace-wide asset inventory with no publish scoping.\n\n### Impact\n\nAn anonymous reader (publish mode with auth disabled) or any publish `RoleReader` obtains the server's absolute workspace path, which typically embeds the OS username, plus the installation directory layout. This is useful for targeting subsequent attacks (path construction, user enumeration, social engineering) and directly contradicts the redaction the project applies in `getConf`. The related endpoints additionally disclose workspace-wide asset inventory, including assets referenced only by publish-forbidden documents. Confidentiality-only.\n\n### Suggested fix\n\nApply the same redaction `getConf` uses: for browser/reader requests, return the asset path relative to the workspace root rather than the absolute host path (or omit it entirely). Add publish-access scoping to `getUnusedAssets` and `getMissingAssets` so their results are limited to documents the caller may see.","state":0,"publishedAt":"2026-09-03T23:00:52+00:00","modifiedAt":"2026-09-10T15:25:52.488091+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260724095509-eee3410aa131"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jv8v-xq2h-657v","https://nvd.nist.gov/vuln/detail/CVE-2026-72802","https://github.com/siyuan-note/siyuan/commit/eee3410aa131b76f1bd72e933d484cf1ece77e88","https://github.com/siyuan-note/siyuan","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-resolveassetpath"],"sourceUrl":"https://github.com/advisories/GHSA-jv8v-xq2h-657v","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-jv8v-xq2h-657v","identifiers":["GHSA-jv8v-xq2h-657v","CVE-2026-72802","GO-2026-6398"]},"retained":false,"historicalAffected":[]},{"revision":"1e54782fb2e34ab1914e8f4e6951cc28","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6398","aliases":["CVE-2026-72802","GHSA-jv8v-xq2h-657v"],"title":"SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath in github.com/siyuan-note/siyuan/kernel","description":"SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath in github.com/siyuan-note/siyuan/kernel","state":0,"publishedAt":"2026-09-10T14:48:42+00:00","modifiedAt":"2026-09-10T15:15:14.1105036+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260724095509-eee3410aa131"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jv8v-xq2h-657v","https://nvd.nist.gov/vuln/detail/CVE-2026-72802","https://github.com/siyuan-note/siyuan/commit/eee3410aa131b76f1bd72e933d484cf1ece77e88","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-resolveassetpath"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6398","license":"OSV · upstream source license applies","key":"osv:GO-2026-6398","identifiers":["GO-2026-6398","CVE-2026-72802","GHSA-jv8v-xq2h-657v"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-25T22:04:08.5875992+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-25T22:04:08.5875992+00:00","lastSuccessAt":"2026-10-25T22:04:08.8596165+00:00","error":null,"lastVerifiedAt":"2026-10-25T22:04:08.8596241+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-1a687ad2a0b90150aa7d97c9f39e63de695ae2db23e31ebc28df1492c461b23c-1c072e7db56f0d3179c99f5b33ed9988c328ad75783993f151d8522bc700aaba","complete":true,"records":414046,"lastAttemptAt":"2026-10-25T22:02:18.7733512+00:00","lastSuccessAt":"2026-10-25T22:02:18.6654575+00:00","error":null,"lastVerifiedAt":"2026-10-25T22:02:18.7733512+00:00","snapshotPublishedAt":"2026-10-25T21:21:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-25T22:04:11.413428+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4764,"expectedIdentifiers":13474},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-25T22:04:08.5875992+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-25T22:04:08.5875992+00:00","lastSuccessAt":"2026-10-25T22:04:08.8610999+00:00","error":null,"lastVerifiedAt":"2026-10-25T22:04:08.8611051+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-204a3fb93a00487e8f7f36db01dc851d","complete":true,"records":13413,"lastAttemptAt":"2026-10-25T22:04:09.4303098+00:00","lastSuccessAt":"2026-10-25T16:19:28.681+00:00","error":null,"lastVerifiedAt":"2026-10-25T16:19:28.681+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13474,"expectedIdentifiers":13474},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-25T22:04:08.4463409+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-25T22:04:08.4463409+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-25T22:02:18.9302775+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-25T22:02:18.9302775+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7da67a15aa6e56a0e3081a7646dc74d537e6ef974afc593c2b1794ed01970648","complete":true,"records":2969,"lastAttemptAt":"2026-10-25T22:04:08.554556+00:00","lastSuccessAt":"2026-10-24T13:19:59.1145547+00:00","error":null,"lastVerifiedAt":"2026-10-25T22:04:08.554556+00:00","snapshotPublishedAt":"2026-10-24T08:47:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-11236ada05a0588e51df37636716526867f73fb127392c49680b6f8561496a99","complete":true,"records":230781,"lastAttemptAt":"2026-10-25T22:04:08.3201814+00:00","lastSuccessAt":"2026-10-25T22:04:07.173333+00:00","error":null,"lastVerifiedAt":"2026-10-25T22:04:08.3201814+00:00","snapshotPublishedAt":"2026-10-25T21:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}