CVE-2026-73605

The CVSS 5.8 score assigned to this vulnerability misrepresents its operational danger. This is not because the underlying flaw is severe in isolation—it is a pre-authentication endpoint that confirms whether arbitrary filesystem paths exist on the host—but because it functions as a reconnaissance oracle that fundamentally changes the economics of an attack against any SiYuan instance it targets. An attacker does not need this endpoint to return file contents. The boolean signal of existence is sufficient: it reveals whether specific software is installed, whether particular configuration directories exist, and whether the host is running server software an attacker might want to target in a subsequent exploitation phase. For SiYuan specifically—deployed by researchers, developers, and technical professionals who aggregate valuable personal and organizational knowledge—this enumeration capability provides exactly the targeting intelligence needed before committing to an exploit chain. The endpoint tells an attacker where the high-value data lives without triggering the forensic noise that would alert defenders. This is the CVSS framework's structural blind spot: it evaluates impact at the vulnerability level, not the campaign level. A 5.8 information disclosure that enables privilege escalation or lateral movement carries strategic weight that the score cannot capture. The low EPSS score (0.00194) likely reflects the application's niche status and limited public awareness rather than genuine exploitability. Unauthenticated filesystem probing is trivially scriptable and leaves minimal forensic trace. Sophisticated actors do not need to broadcast-scan for this endpoint—they probe quietly against targets of interest, which explains why honeypot data may show nothing without indicating absence of targeting. What should drive urgency is the patch quality question. If v3.7.4 implements shallow deny-listing or only constrains input format without canonical path validation, the architectural assumption that "existence checks don't need authentication" remains intact within the codebase. Future developers will face the same temptation to add similar endpoints, and this vulnerability class will mutate again—as it has repeatedly over two decades across Confluence, GitLab, Jenkins, and now SiYuan. The recurring pattern suggests the industry treats these vulnerabilities as isolated flaws rather than symptoms of a durable architectural belief that authentication is a "separate concern" from filesystem operations. For defenders, the operational priority should be determined by network exposure. SiYuan instances running on localhost or isolated internal networks face minimal incremental risk from this endpoint. Instances exposed to the internet or networked adjacently to development tools, CI/CD pipelines, or other high-value systems should be prioritized for patching regardless of the CVSS score, because the filesystem oracle transforms a knowledge-management tool into an intelligence-gathering pivot point that feeds subsequent attack stages.

Reviewed through automated stages and approved by a human before publication.