{"uuid": "c2f968b3-519b-4a53-aab9-3ded6c255362", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-jv8v-xq2h-657v", "type": "seen", "source": "https://gist.github.com/alon710/be44b044fa32d940cf485868087a9fe9", "content": "# CVE-2026-72802: CVE-2026-72802: Sensitive Information Disclosure via Administrative Asset Resolvers in SiYuan Note\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72802\n\n## Summary\nSiYuan Note versions prior to v3.7.4 contain an information disclosure vulnerability in the `/api/asset/resolveAssetPath` endpoint. This endpoint returns absolute backend filesystem paths unmodified to CheckAuth-only requests. Low-privileged users or unauthenticated readers under publish mode can exploit this to leak the local directory layout, operating system username, and overall host deployment structure.\n\n## TL;DR\nAn authorization bypass through user-controlled keys in SiYuan Note allows unauthenticated readers to extract absolute local filesystem paths, exposing host usernames and operating system layout information.\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Note\n- **SiYuan**: < 3.7.4 (Fixed in: `v3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan Note to version v3.7.4 or newer.\n- Incorporate Nginx or reverse proxy rules to block external access to administrative asset endpoints.\n- Temporarily disable publish mode to restrict anonymous read access.\n\n**Remediation Steps:**\n1. Identify the version of the currently running SiYuan Note instance.\n2. Download the v3.7.4 (or later) update package from the official repository.\n3. Stop the running container or application service.\n4. Deploy the updated binaries or pull the updated Docker image.\n5. Restart the SiYuan Note service.\n6. Validate the fix by sending a test POST request to `/api/asset/resolveAssetPath` using a low-privileged session and verify that the server returns an HTTP 403 Forbidden status.\n\n## References\n\n- [GitHub Security Advisory GHSA-jv8v-xq2h-657v](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jv8v-xq2h-657v)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-resolveassetpath)\n- [SiYuan Note Commit eee3410aa131b76f1bd72e933d484cf1ece77e88](https://github.com/siyuan-note/siyuan/commit/eee3410aa131b76f1bd72e933d484cf1ece77e88)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72802) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T03:32:06.275091Z"}