https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T21:02:25.989561+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-352754 EUVD-2026-352754 2026-10-08T21:02:25.991551+00:00 EUVD-2026-352754 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72796 fkie_cve-2026-72796 2026-10-08T21:02:25.991583+00:00

SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the server mux bypass publish-access controls enforced on the REST API. Attackers with publish reader tokens or anonymous access in disabled-auth mode can read templates, snippets, and export artifacts by directly accessing static routes that lack the same restrictions as their REST API counterparts.

 https://cve.radiocsirt.org/vuln/ghsa-fgmr-7w36-9qfq GHSA-fgmr-7w36-9qfq — SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets an… 2026-10-08T21:02:25.991614+00:00

Affected: Go: github.com/siyuan-note/siyuan/kernel

**CVE:** This vulnerability corresponds to [CVE-2026-72796](https://nvd.nist.gov/vuln/detail/CVE-2026-72796).

### Summary

Several static-file routes in the server mux (`kernel/server/serve.go`) are registered with `CheckAuth` only and serve directories directly, without the publish-access checks, sensitive-path blocklist, or `refuseToAccess` rules that the REST API applies to the same data. They are therefore reachable by the publish `RoleReader` token and by the anonymous account when `Publish.Auth.Enable` is `false`.

Most notably, `/templates/` serves `data/templates` a directory the REST file API explicitly refuses to serve to non-administrators.

### Details

| Route | Registration | Guard | Exposed to a reader | |---|---|---|---| | `/templates/*` (line 424) | `Group("/templates/", model.CheckAuth).Static("", data/templates)` | none beyond path cleaning | the templates directory | | `/snippets/*` (line 434) | `CheckAuth` | blocks only `conf.json` | any snippet's JS/CSS content by name | | `/widgets/`, `/plugins/`, `/emojis/` (409/414/419) | `Group(CheckAuth).Static(dir)` | none | whole directory trees | | `/export/*` (line 320) | `Group("/export/", CheckAuth)` | traversal, sensitive-path and DEK guards: **no publish check** | export artifacts (PDF/HTML/DOCX/CSV) |

**`/templates/` directly contradicts an existing control.** The REST file path runs `refuseToAccess` (`kernel/api/file.go:551-553`), which explicitly returns 403 for `data/templates/` to non-administrators…