THREAT OPS › Threat News › [GHSA] GHSA-jv8v-xq2h-657v (medium) — SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath
[GHSA] GHSA-jv8v-xq2h-657v (medium) — SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath
GHSA-jv8v-xq2h-657v Severity: medium CVE: CVE-2026-72802
SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath
**CVE:** This vulnerability corresponds to CVE-2026-72802.
### Summary
`POST /api/asset/resolveAssetPath` returns the resolved **absolute** filesystem path of an asset, unmodified. The route is `CheckAuth`-o
MITRE ATT&CK techniques
- Social EngineeringT1684
Indicators of compromise
- CVE-2026-72802cve
- http://127.0.0.1:6808/api/asset/resolveAssetPathurl
- http://127.0.0.1:6808/api/asset/getUnusedAssetsurl
- http://127.0.0.1:6808/api/asset/getMissingAssetsurl
Original source: https://github.com/advisories/GHSA-jv8v-xq2h-657v