CVE-2026-72802

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description An information disclosure issue exists in the 'resolveAssetPath' endpoint. The endpoint returns absolute filesystem paths unmodified when processing CheckAuth-only requests. An attacker can collect relative asset paths from published documents and submit them to 'resolveAssetPath' to retrieve the server's absolute workspace path, which reveals the operating-system username and the installation layout.

Recommendations Update SiYuan to version 3.7.4 or later.