{"vulnerability": "cve-2026-72799", "sightings": [{"uuid": "68046f44-ff15-43a9-b72f-b41cb0365924", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72799", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-5w7r-f4cg-rqq7", "content": "", "creation_timestamp": "2026-09-04T22:35:23.800165Z"}, {"uuid": "a7a5985a-4da3-489d-9d02-34cd06ceccbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72799", "type": "seen", "source": "https://gist.github.com/alon710/abc6a26fdebf669c87f091f304527249", "content": "# CVE-2026-72799: CVE-2026-72799: Missing Authorization in SiYuan Filetree Path-Resolution API\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72799\n\n## Summary\nSiYuan before v3.7.4 fails to enforce publish-access filters on five filetree path-resolution endpoints, allowing unauthenticated attackers to reconstruct private directory layouts and map document structures.\n\n## TL;DR\nUnauthenticated remote attackers can query specific path-resolution APIs in SiYuan to discover the structures, names, and IDs of private, hidden, or password-protected documents when deployed in public publish mode.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS v4.0**: 6.9\n- **EPSS Score**: 0.00237 (Percentile: 14.53%)\n- **Impact**: Information Disclosure / Metadata Leakage\n- **Exploit Status**: Proof-of-Concept / Patch-based Analysis\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **SiYuan**: < v3.7.4 (Fixed in: `v3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to version v3.7.4 or higher.\n- Enable Publish Authentication by setting Publish.Auth.Enable to true.\n- Restrict access to /api/filetree/ endpoints using a reverse proxy.\n\n**Remediation Steps:**\n1. Identify self-hosted SiYuan installations and check current version numbers.\n2. Update the application deployment using the official Docker image or binary to v3.7.4.\n3. Verify the updated installation by attempting to query /api/filetree/getHPathByID without an active authorization token.\n\n## References\n\n- [GitHub Security Advisory GHSA-5w7r-f4cg-rqq7](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5w7r-f4cg-rqq7)\n- [Fix Commit 5bae092](https://github.com/siyuan-note/siyuan/commit/5bae0926b896eaff0bc5cc6a75d421c2d161a806)\n- [CVE-2026-72799 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-72799)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72799) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T10:31:56.346667Z"}]}