CVE-2026-72802: Sensitive Information Disclosure via Administrative Asset Resolvers in SiYuan Note

SiYuan Note is a local-first personal knowledge management system designed to support offline-first editing, cloud synchronization, and self-hosted publishing. When configured in publish mode, the application allows documents and accompanying assets to be shared with standard users or the public web.

The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The affected components are the administrative-tier asset resolution APIs located inside the Go-based application backend. These endpoints fail to restrict access to authenticated administrative users, exposing severe structural information to lower-privileged read-only roles.

An attacker interacting with a public or low-privileged view of a SiYuan Note instance can query the server's asset management routing paths. By specifying relative asset paths harvested from published notes, the attacker can leverage the underlying application directory mapping handlers to retrieve unmasked absolute backend file paths. This disclosure exposes local user directory structures, OS layouts, and underlying host configuration environments.

The vulnerability stems from an inadequate authorization architecture in kernel/api/router.go. Specifically, three sensitive administrative endpoints are registered with only basic session verification middleware: /api/asset/resolveAssetPath, /api/asset/getUnusedAssets, and /api/asset/getMissingAssets.

The fundamental middleware layer model.CheckAuth ensures that a requester has a valid session. However, under SiYuan's permission model, when an instance is in publish mode, anonymous visitors or low-privileged users (such as those holding the model.RoleReader role) possess a valid session state that satisfies this basic check.

When a request reaches the /api/asset/resolveAssetPath endpoint, the internal application logic retrieves the storage path of the specified asset by executing model.GetAssetAbsPathInBox(path, ""). Because the API handler directly returns the output of this resolution to the response buffer without sanitizing, mapping, or relativizing the string, the host server's local file paths are returned to the client in plain text.

Analyzing the patch in kernel/api/router.go confirms that the vulnerability was resolved by appending the model.CheckAdminRole middleware to the vulnerable routes.

Below is the comparison between the vulnerable and patched endpoint definitions:

// Vulnerable routing configuration
ginServer.Handle("POST", "/api/asset/resolveAssetPath", model.CheckAuth, resolveAssetPath)
ginServer.Handle("POST", "/api/asset/getUnusedAssets", model.CheckAuth, getUnusedAssets)
ginServer.Handle("POST", "/api/asset/getMissingAssets", model.CheckAuth, getMissingAssets)
 
// Patched routing configuration
ginServer.Handle("POST", "/api/asset/resolveAssetPath", model.CheckAuth, model.CheckAdminRole, resolveAssetPath)
ginServer.Handle("POST", "/api/asset/getUnusedAssets", model.CheckAuth, model.CheckAdminRole, getUnusedAssets)
ginServer.Handle("POST", "/api/asset/getMissingAssets", model.CheckAuth, model.CheckAdminRole, getMissingAssets)

The implementation of model.CheckAdminRole intercepts incoming requests, extracts the associated context variables mapped in Gin (model.RoleContextKey), and guarantees that only clients with verified administrative roles are allowed to access the route. If the context contains a lower privilege tier like model.RoleReader, the middleware stops further execution and responds with a 403 Forbidden status.

To ensure this regression is permanently blocked, the developer implemented a unit test file kernel/api/asset_authorization_test.go. The test artificially assigns the RoleReader permission context to the requests and verifies that invoking any of the three endpoints yields a strict 403 status:

func TestAssetAdminEndpointsRejectReader(t *testing.T) {
	gin.SetMode(gin.TestMode)
	engine := gin.New()
	engine.Use(func(c *gin.Context) {
		c.Set(model.RoleContextKey, model.RoleReader)
		c.Next()
	})
	ServeAPI(engine)
	tests := []struct {
		path string
		body string
	}{
		{path: "/api/asset/resolveAssetPath", body: `{"path":"assets/test.png"}`},
		{path: "/api/asset/getUnusedAssets", body: `{}`},
		{path: "/api/asset/getMissingAssets", body: `{}`},
	}
	for _, test := range tests {
		t.Run(test.path, func(t *testing.T) {
			recorder := httptest.NewRecorder()
			request := httptest.NewRequest(http.MethodPost, test.path, strings.NewReader(test.body))
			request.Header.Set("Content-Type", "application/json")
			engine.ServeHTTP(recorder, request)
			if recorder.Code != http.StatusForbidden {
				t.Fatalf("reader request returned status %d: %s", recorder.Code, recorder.Body.String())
			}
		})
	}
}

To exploit this vulnerability, an attacker first locates a public-facing SiYuan Note application instance with Publish Mode enabled. By viewing any accessible page, the attacker inspects the DOM or source elements to identify valid relative asset paths utilized by the server. These paths are commonly formatted as assets/image-<timestamp>.png.

Using these relative assets, the attacker constructs an HTTP POST request targeted at /api/asset/resolveAssetPath. The request body contains the target relative path wrapped in JSON:

POST /api/asset/resolveAssetPath HTTP/1.1
Host: target-siyuan.example.com
Content-Type: application/json
Connection: close
 
{
  "path": "assets/image-20260724.png"
}

Upon receiving the request, the unpatched server resolves the filesystem path using local working directories and transmits the raw path back to the sender:

HTTP/1.1 200 OK
Content-Type: application/json
Connection: close
 
{
  "code": 0,
  "msg": "",
  "data": "/home/siyuan_user/.siyuan/data/assets/image-20260724.png"
}

This response reveals the operating system flavor, the path structures of the deployment, and the username siyuan_user. This harvested structural intelligence can then be used to construct more precise paths for directory traversal or server-side file-inclusion exploits in adjacent components.

The direct impact of CVE-2026-72802 is low-to-moderate information disclosure. While it does not directly permit remote code execution, database modification, or denial of service, it removes a critical layer of defense-in-depth.

By disclosing the absolute backend paths, an attacker gains exact structural maps of the server. Knowing the path /home/siyuan_user/.siyuan/data/... allows the attacker to learn the local username and verify directory patterns. On Windows servers, this may leak drive letters and system path names, highlighting specific administrative directory trees.

This intelligence streamlines the creation of targeted exploits. If a secondary vulnerability (such as an arbitrary file write or local file read) is discovered, the attacker can leverage these exact absolute paths to bypass path guessing entirely, making subsequent attacks highly reliable.

The primary recommendation is to update the SiYuan Note instance to version v3.7.4 or higher immediately. This introduces the authorization role checking layer, preventing any low-privileged or unauthenticated sessions from invoking the asset-resolving endpoints.

If patching cannot be performed immediately, the following temporary mitigations can be implemented to minimize exposure:

1. Disable Publish Mode: Restricting the application to single-user local setups without web publishing prevents anonymous connections from reaching the API layer.
2. Implement Reverse Proxy Filter Rules: Configure front-end web servers (such as Nginx, Caddy, or Traefik) to actively drop requests pointing to the affected endpoints.

For example, an Nginx block can reject external traffic targeting these administrative endpoints:

location ~* /api/asset/(resolveAssetPath|getUnusedAssets|getMissingAssets) {
    return 403;
}