SiYuan versions up to 3.7.2 have a vulnerability where publish-access filters are not enforced on certain filetree path-resolution endpoints. This allows unauthenticated users or any publish reader token to enumerate the entire private document tree, including hidden, password-protected, or publish-forbidden documents. The vulnerability has a CVSS score of 5.8, indicating medium severity. This advisory is a duplicate and has been withdrawn in favor of GHSA-5w7r-f4cg-rqq7.