CVE-2026-72799

Deferred Deferred - Pending Action

SiYuan Path Traversal in Publish Mode

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: VulnCheck

Description

SiYuan before v3.7.4 (affected <=v3.7.2) fails to enforce publish-access filters on five filetree path-resolution endpoints (getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath). In publish mode, when Publish.Auth.Enable is false, an unauthenticated (anonymous) reader — or any publish reader token — can call these endpoints to enumerate the complete private document tree, mapping notebook names, folder hierarchies, and document titles, and resolving title paths to document IDs, including for documents marked hidden, password-protected, or publish-forbidden.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-72799

EUVD

EUVD-2026-57459

Affected Vendors & Products

Vendor	Product	Version / Range
si_yuan	si_yuan	to 3.7.4 (exc)
siyuan	siyuan	to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-72799 is an information disclosure vulnerability in SiYuan note-taking app versions up to v3.7.2. It allows unauthenticated users to access private document trees through five filetree path-resolution endpoints when publish mode is enabled without authentication. These endpoints fail to enforce publish-access filters, enabling enumeration of notebook names, folder hierarchies, document titles, and document IDs, including hidden or password-protected files.

Detection Guidance

To detect this vulnerability, check if your SiYuan instance is running version <=3.7.2. Monitor network traffic for unauthorized access attempts to the endpoints getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath. Look for requests with publish mode enabled and no authentication.

Impact Analysis

An attacker could exploit this to map your entire private document structure, revealing sensitive information like notebook names, folder layouts, and document titles. This could lead to further unauthorized access to restricted documents if combined with other vulnerabilities. The impact is primarily on confidentiality as private data is exposed without authentication.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection regulations like GDPR and HIPAA, which mandate strict access controls and protection of sensitive information. The unauthorized disclosure of private document structures and metadata could constitute a breach of confidentiality obligations under these regulations.

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later. If upgrading is not immediately possible, disable publish mode or enable Publish.Auth.Enable to enforce authentication. Ensure publish-access filters are applied to the vulnerable endpoints.

Hi! I’m here to help you understand CVE-2026-72799. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70