Executive brief
SiYuan is a popular note-taking and personal knowledge management application. The application's asset resolution endpoint exposes absolute filesystem paths and OS usernames to any reader with access to published documents, even when authentication is disabled. An attacker can learn the server's installation directory and operating system username by making a simple API call with asset filenames visible in published content.
Technical details
The vulnerability is an information disclosure flaw in the resolveAssetPath handler in kernel/api/asset.go. The endpoint calls GetAssetAbsPathInBox(path, "") which returns absolute filesystem paths such as C:\Users\<username>\SiYuan\data\assets\foo.png or /home/<user>/..., and returns this path directly to the caller with no redaction. The route is CheckAuth-only (no administrative role required), making it accessible to anonymous readers when Publish.Auth.Enable is false, or to any publish RoleReader token. An attacker can harvest relative asset paths from HTML markup in published documents (e.g., assets/foo-20260101120000-abcdefg.png) and POST them to the endpoint to resolve the full path. Related endpoints getUnusedAssets and getMissingAssets suffer similar issues, returning workspace-wide asset inventory without publish scoping. The project already treats these directory paths as sensitive, as evidenced by getConf which explicitly zeroes WorkspaceDir, DataDir, and HomeDir when util.IsBrowserRequest(c) (issue #17410); resolveAssetPath re-exposes precisely these redacted values. Attack vector is network, no authentication required, no user interaction needed.
Affected products
- SiYuan SiYuan before 0.0.0-20260724095509-eee3410aa131
Timeline
- 2026-07-24: disclosed: Vulnerability identified and disclosed to siyuan-note/siyuan
- 2026-07-24: patched: Fix committed with hash eee3410aa131b76f1bd72e933d484cf1ece77e88
- 2026-09-03: advisory: GitHub Security Advisory GHSA-jv8v-xq2h-657v published