Listen to this Post
The vulnerability in CVE-2026-72802 arises from a discrepancy in how SiYuan Note handles sensitive path information across different API endpoints. The core issue is with the `POST /api/asset/resolveAssetPath` endpoint, which is designed to resolve a relative asset path to its absolute filesystem location. The endpoint is protected only by a `CheckAuth` middleware, meaning it is accessible to any authenticated user, including the low-privilege `RoleReader` token used for publish mode, and even anonymous users if the `Publish.Auth.Enable` configuration is set to false.
When the function `resolveAssetPath` is called, it internally uses model.GetAssetAbsPathInBox(path, ""). The empty `boxID` parameter causes the function to resolve the path against the absolute workspace directory on the host system, such as `C:\Users\
This leakage is particularly damaging because the SiYuan project has already recognized the sensitivity of this information. In a previous security fix (issue 17410), the `getConf` endpoint was modified to explicitly zero out fields like System.WorkspaceDir, AppDir, ConfDir, DataDir, and `HomeDir` when the request is identified as a browser request using util.IsBrowserRequest(c). This patch was implemented specifically to prevent the disclosure of the operating system username and the exact installation layout to unprivileged clients. However, `resolveAssetPath` fails to apply this same redaction logic, thereby re-exposing exactly the information that `getConf` was designed to hide.
Furthermore, two sibling endpoints in the same file, `getMissingAssets` and getUnusedAssets, suffer from a similar lack of publish-scoping. These endpoints return a list of missing asset references or a list of unused asset filenames across the entire workspace, including assets contained in documents that are not published or are forbidden for the current user to access. This broad inventory disclosure can provide an attacker with a comprehensive map of the workspace’s asset structure, aiding in further reconnaissance.
The attack vector is straightforward. An attacker operating under publish mode (with or without authentication, depending on the `Publish.Auth.Enable` setting) can harvest a relative asset path from any published document’s HTML source, e.g., assets/foo-20260101120000-abcdefg.png. By sending a POST request to `/api/asset/resolveAssetPath` with this path in the JSON body, the server will respond with the full host path, revealing the username and installation directory. This directly contradicts the intended behavior of the system, as confirmed by the simultaneous `getConf` request from the same session returning blank values for the same sensitive paths, proving the discrepancy is not a feature but an oversight.
DailyCVE Form:
Platform: SiYuan Note
Version: origin/master
Vulnerability: Path Disclosure
Severity: Medium
date: 2026-09-04
Prediction: 2026-09-14
What Undercode Say:
The discrepancy in this CVE highlights a critical oversight in endpoint parity. While getConf was properly patched to redact sensitive paths for browser requests, resolveAssetPath was left unchanged, creating a significant information disclosure vector. The related getMissingAssets and getUnusedAssets endpoints further compound the issue by exposing asset inventory without proper scope checks. This is a classic case of incomplete patching where one vulnerability was fixed while a similar logic flaw persisted elsewhere in the codebase.
Analytics:
`grep -rn “resolveAssetPath” kernel/api/asset.go`
`grep -rn “GetAssetAbsPathInBox” model/`
`find . -name “.go” | xargs grep -l “IsBrowserRequest”`
Exploit: (Educational Purposes!)
- Step 1: Identify the target’s publish endpoint (e.g., http://127.0.0.1:6808).
- Step 2: Open any published page and extract a relative asset path from an `
` tag.
- Step 3: Send a POST request to the vulnerable endpoint.
`curl -X POST http://127.0.0.1:6808/api/asset/resolveAssetPath -H “Content-Type: application/json” -d ‘{“path”:”assets/known-file.png”}’`
Protection:
- Apply redaction logic to the `resolveAssetPath` handler by checking `util.IsBrowserRequest(c)` and returning a relative path or a generic placeholder instead of the absolute host path.
- Implement publish-scope filtering for `getMissingAssets` and `getUnusedAssets` to ensure the returned inventory is limited to assets belonging to documents the caller has permission to view.
- Consider introducing a dedicated middleware that enforces consistent redaction rules for all endpoints returning filesystem-related information, preventing similar leaks in the future.
Impact:
An anonymous or low-privileged user can obtain the server’s absolute workspace path, revealing the operating system username and the exact installation directory structure. This information can be leveraged for path traversal attacks, OS user enumeration, and targeted social engineering, as the attacker can infer the environment layout. Additionally, the related endpoints disclose a list of all missing or unused assets, exposing the application’s internal asset management and potentially revealing content from unpublished or private documents, which violates confidentiality expectations for the publish feature.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
