CVE-2026-72802Medium· 5.3▾ SunlitSiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
0.2% → 0.3%
CVE: This vulnerability corresponds to CVE-2026-72802.
POST /api/asset/resolveAssetPath returns the resolved absolute filesystem path of an asset, unmodified. The route is CheckAuth-only, so it is reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false. An anonymous reader who knows any asset's relative path trivially harvested from an <img src="assets/…"> in any published document receives the server's absolute workspace path, disclosing the operating-system username and the installation layout.
// kernel/api/asset.go: resolveAssetPath
p, err := model.GetAssetAbsPathInBox(path, "") // boxID="" → absolute workspace path
...
ret.Data = p // returned raw, no stripping
GetAssetAbsPathInBox(path, "") resolves under util.DataDir / util.WorkspaceDir, producing a full host path such as C:\Users\<username>\SiYuan\data\assets\foo.png or /home/<user>/…. The handler returns it directly with no redaction and no publish-scope check.
This is data the project already treats as sensitive. getConf explicitly zeroes System.WorkspaceDir, AppDir, ConfDir, DataDir, and HomeDir when util.IsBrowserRequest(c), a change made specifically to avoid leaking the username (issue #17410). resolveAssetPath performs no equivalent stripping, so it re-exposes precisely the values getConf was patched to hide.
Related unfiltered siblings in the same file, also CheckAuth-only with no publish scoping:
getMissingAssets: workspace-wide list of missing asset referencesgetUnusedAssets: every unused asset filename in the assets directoryBoth return asset inventory spanning all documents, including publish-forbidden ones.
Verified at origin/master: resolveAssetPath returns the absolute path with no redaction, getConf contains the IsBrowserRequest stripping; all three routes are registered CheckAuth without CheckAdminRole.
Precondition: publish mode enabled (default port 6808); anonymous when Publish.Auth.Enable is false, otherwise any publish reader account.
1. Harvest an asset path: open any published document and read a relative asset path from its markup, e.g. assets/foo-20260101120000-abcdefg.png.
2. Resolve it as an anonymous reader:
POST http://127.0.0.1:6808/api/asset/resolveAssetPath
{"path":"assets/foo-20260101120000-abcdefg.png"}
3. Result: the response returns the absolute host path, e.g.
C:\Users\<username>\SiYuan\data\assets\foo-...png disclosing the OS username and the full workspace/installation layout.
Control: getConf from the same anonymous session returns WorkspaceDir/DataDir/HomeDir blanked, confirming the project intends these values to be withheld from browser requests.
Related:
POST http://127.0.0.1:6808/api/asset/getUnusedAssets {}
POST http://127.0.0.1:6808/api/asset/getMissingAssets {}
Return workspace-wide asset inventory with no publish scoping.
An anonymous reader (publish mode with auth disabled) or any publish RoleReader obtains the server's absolute workspace path, which typically embeds the OS username, plus the installation directory layout. This is useful for targeting subsequent attacks (path construction, user enumeration, social engineering) and directly contradicts the redaction the project applies in getConf. The related endpoints additionally disclose workspace-wide asset inventory, including assets referenced only by publish-forbidden documents. Confidentiality-only.
Apply the same redaction getConf uses: for browser/reader requests, return the asset path relative to the workspace root rather than the absolute host path (or omit it entirely). Add publish-access scoping to getUnusedAssets and getMissingAssets so their results are limited to documents the caller may see.
github.com/siyuan-note/siyuan/kernel < 0.0.0-20260724095509-eee3410aa131Upgrade to a patched release:
github.com/siyuan-note/siyuan/kernel 0.0.0-20260724095509-eee3410aa131Connected by shared product, vendor, weakness, or advisory.
GHSA-gq43-vcrh-6jw8Medium· 5.8Duplicate Advisory: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block
GHSA-hg5w-8ppq-wpjqHigh· 7.5Duplicate Advisory: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream, defeating the fix for GHSA-xp2m-98x8-rpj6
GHSA-989h-w3q9-3m2fMedium· 6.6Duplicate Advisory: SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
GHSA-6xvp-3rfv-g2g2Medium· 5.8Duplicate Advisory: SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers
GHSA-xp3q-r38w-vgqmMedium· 5.8SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized
GHSA-vg9q-fc8f-43f3Medium· 5.8Duplicate Advisory: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden