SiYuan versions up to 3.7.2 have an information disclosure vulnerability in the resolveAssetPath endpoint. This endpoint returns absolute filesystem paths in response to CheckAuth-only requests, allowing attackers to obtain the server's absolute workspace path, including the operating system username and installation layout. The advisory is a duplicate of GHSA-jv8v-xq2h-657v and has been withdrawn to preserve references.