Kernel: Duplicate Advisory: Absolute filesystem path and OS username disclosure via resolveAssetPath

SiYuan versions <=3.7.2 contain an information disclosure vulnerability (CWE-639) in the resolveAssetPath endpoint. This endpoint returns absolute filesystem paths unmodified to CheckAuth-only requests. Attackers can leverage relative asset paths from published documents and submit them to resolveAssetPath to retrieve the server's absolute workspace path, disclosing sensitive information such as the OS username and installation layout. The vulnerability has a CVSS 3.1 score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. The advisory is a duplicate and withdrawn in favor of GHSA-jv8v-xq2h-657v.

An attacker can obtain absolute filesystem paths from the server, including the operating system username and installation layout. This information disclosure can aid further reconnaissance but does not directly affect integrity or availability.

Patch status is not confirmed in this advisory. No patch links are provided. Check the vendor advisory GHSA-jv8v-xq2h-657v for current remediation guidance. Until a fix is applied, restrict access to the resolveAssetPath endpoint or implement access controls to prevent unauthorized information disclosure.