CVE-2026-72802
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Aug 12, 2026
Vendor
unknown
Description
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that returns absolute filesystem paths unmodified to CheckAuth-only requests. Attackers can harvest relative asset paths from published documents and submit them to resolveAssetPath to obtain the server's absolute workspace path, disclosing the operating-system username and installation layout.