Executive brief
SiYuan is a note-taking application with a publish feature allowing document sharing. The resolveAssetPath endpoint inadvertently exposes the server's absolute filesystem path, including the OS username and installation directory, to unauthenticated or minimally-authenticated users who can guess asset paths from published documents. An attacker can leverage this information to conduct reconnaissance for follow-up attacks, enumerate users, or socially engineer administrators.
Technical details
The vulnerability exists in the resolveAssetPath API endpoint (kernel/api/asset.go), which resolves relative asset paths and returns the absolute filesystem path unredacted. The endpoint is CheckAuth-only, making it accessible to unauthenticated readers in publish mode when Publish.Auth.Enable is false, or to any user with the publish RoleReader role. An attacker harvests asset paths from img src attributes in published documents (e.g., "assets/foo-20260101120000-abcdefg.png") and submits them to resolveAssetPath to retrieve the full absolute path (e.g., C:\Users\<username>\SiYuan\data\assets\foo.png or /home/<user>/…). The project already redacts these paths in the getConf endpoint for browser requests to prevent username leakage, but resolveAssetPath performs no equivalent filtering. Patched versions (v3.7.4 and later) apply proper redaction. Two related endpoints, getMissingAssets and getUnusedAssets, also expose workspace-wide asset inventory without publish-scope filtering.
Affected products
- SiYuan SiYuan <= 3.7.2
Timeline
- 2026-08-12: disclosed: Published to GitHub Advisory Database
- 2026-07-24: patched: Fix released in v3.7.4 (referenced in GHSA-jv8v-xq2h-657v)
- 2026-09-03: advisory: Duplicate advisory GHSA-72xp-24p9-7vpf withdrawn in favor of GHSA-jv8v-xq2h-657v