Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SiYuan before v3.7.4 (affected <=v3.7.2) fails to enforce publish-access filters on five filetree path-resolution endpoints (getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath). In publish mode, when Publish.Auth.Enable is false, an unauthenticated (anonymous) reader — or any publish reader token — can call these endpoints to enumerate the complete private document tree, mapping notebook names, folder hierarchies, and document titles, and resolving title paths to document IDs, including for documents marked hidden, password-protected, or publish-forbidden.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🟠 SiYuan Publish, Path Resolution Information Disclosure, #CVE-2026-72799 (Medium) -DC-Sep2026-2205 https://dailycve.com/siyuan-publish-path-resolution-information-disclosure-cve-2026-72799-medium-dc-sep2026-2205/
Post summary
A new CVE, CVE‑2026‑72799, was publicly disclosed for SiYuan Publish, outlining a Path Resolution Information Disclosure vulnerability rated Medium in severity.