CVE-2026-72802 is a medium-severity (CVSS 5.3) CWE-639 vulnerability in github.com/siyuan-note/siyuan/kernel. O3 Security confirms whether CVE-2026-72802 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-72802.
Real-World Exposure
github.com/siyuan-note/siyuan/kernelReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
CVE: This vulnerability corresponds to CVE-2026-72802.
Summary
POST /api/asset/resolveAssetPath returns the resolved absolute filesystem path of an asset, unmodified. The route is CheckAuth-only, so it is reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false. An anonymous reader who knows any asset's relative path trivially harvested from an <img src="assets/…"> in any published document receives the server's absolute workspace path, disclosing the operating-system username and the installation layout.
Details
// kernel/api/asset.go: resolveAssetPath
p, err := model.GetAssetAbsPathInBox(path, "") // boxID="" → absolute workspace path
...
ret.Data = p // returned raw, no stripping
GetAssetAbsPathInBox(path, "") resolves under util.DataDir / util.WorkspaceDir, producing a full host path such as C:\Users\<username>\SiYuan\data\assets\foo.png or /home/<user>/…. The handler returns it directly with no redaction and no publish-scope check.
This is data the project already treats as sensitive. getConf explicitly zeroes System.WorkspaceDir, AppDir, ConfDir, DataDir, and HomeDir when util.IsBrowserRequest(c), a change made specifically to avoid leaking the username (issue #17410). resolveAssetPath performs no equivalent stripping, so it re-exposes precisely the values getConf was patched to hide.
Related unfiltered siblings in the same file, also CheckAuth-only with no publish scoping:
getMissingAssets: workspace-wide list of missing asset referencesgetUnusedAssets: every unused asset filename in the assets directory
Both return asset inventory spanning all documents, including publish-forbidden ones.
Verified at origin/master: resolveAssetPath returns the absolute path with no redaction, getConf contains the IsBrowserRequest stripping; all three routes are registered CheckAuth without CheckAdminRole.
Proof of Concept
Precondition: publish mode enabled (default port 6808); anonymous when Publish.Auth.Enable is false, otherwise any publish reader account.
1. Harvest an asset path: open any published document and read a relative asset path from its markup, e.g. assets/foo-20260101120000-abcdefg.png.
2. Resolve it as an anonymous reader:
POST http://127.0.0.1:6808/api/asset/resolveAssetPath
{"path":"assets/foo-20260101120000-abcdefg.png"}
3. Result: the response returns the absolute host path, e.g.
C:\Users\<username>\SiYuan\data\assets\foo-...png disclosing the OS username and the full workspace/installation layout.
Control: getConf from the same anonymous session returns WorkspaceDir/DataDir/HomeDir blanked, confirming the project intends these values to be withheld from browser requests.
Related:
POST http://127.0.0.1:6808/api/asset/getUnusedAssets {}
POST http://127.0.0.1:6808/api/asset/getMissingAssets {}
Return workspace-wide asset inventory with no publish scoping.
Impact
An anonymous reader (publish mode with auth disabled) or any publish RoleReader obtains the server's absolute workspace path, which typically embeds the OS username, plus the installation directory layout. This is useful for targeting subsequent attacks (path construction, user enumeration, social engineering) and directly contradicts the redaction the project applies in getConf. The related endpoints additionally disclose workspace-wide asset inventory, including assets referenced only by publish-forbidden documents. Confidentiality-only.
Suggested fix
Apply the same redaction getConf uses: for browser/reader requests, return the asset path relative to the workspace root rather than the absolute host path (or omit it entirely). Add publish-access scoping to getUnusedAssets and getMissingAssets so their results are limited to documents the caller may see.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/siyuan-note/siyuan/kernel | all versions | 0.0.0-20260724095509-eee3410aa131 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/siyuan-note/siyuan/kernel. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update github.com/siyuan-note/siyuan/kernel to 0.0.0-20260724095509-eee3410aa131 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-72802 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-72802 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-72802. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-72802 in your dependencies?
O3 detects CVE-2026-72802 across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.