CVE-2026-72796

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description An access control bypass exists in the server mux where several static-file routes bypass the publish-access controls enforced on the REST API. This allows attackers with publish reader tokens or anonymous access (when authentication is disabled) to read sensitive data by directly accessing static routes that lack the restrictions applied to the REST API. Specifically, the /templates/ route allows access to the templates directory, which the REST API explicitly restricts to administrators. Other affected routes include /snippets/, /widgets/, /plugins/, /emojis/, and /export/. Through the /export/ endpoint, a reader may retrieve export artifacts (such as PDF, HTML, DOCX, or CSV files) of documents outside their authorized publish scope if the artifact name is predictable. This issue affects the confidentiality of user-authored templates, snippet source code (JS/CSS), and exported document content.

Recommendations Update SiYuan to version 3.7.4 or later. As a temporary mitigation, restrict access to the /templates/, /snippets/, and /export/ routes for reader roles.