THREAT OPS › Threat News › [GHSA] GHSA-v7ph-r5r6-4jcj (medium) — SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)
[GHSA] GHSA-v7ph-r5r6-4jcj (medium) — SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)
GHSA-v7ph-r5r6-4jcj Severity: medium CVE: CVE-2026-72808
SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)
**CVE:** This vulnerability corresponds to CVE-2026-72808.
### Summary
The `/api/asset/getFileAnnotation` endpoint returns the content of `.sya` PD
Indicators of compromise
- CVE-2026-72808cve
- http://127.0.0.1:6808/api/asset/getFileAnnotationurl
Original source: https://github.com/advisories/GHSA-v7ph-r5r6-4jcj