Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/siyuan-note/siyuan/kernel | go | < 0.0.0-20260724112156-5bae0926b896 | 0.0.0-20260724112156-5bae0926b896 |
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2026-72799 in SiYuan is an information disclosure flaw where five filetree endpoints (getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath) failed to enforce publish-access checks. This allowed unauthenticated users or those with a RoleReader token to enumerate the complete private document structure, including titles, folders, and notebook names, even for content marked as hidden, password-protected, or publish-forbidden. The provided commit 5bae0926b896eaff0bc5cc6a75d421c2d161a806 directly addresses this by introducing access control checks within these specific functions in kernel/api/filetree.go. The patch adds conditional logic to check model.IsReadOnlyRoleContext and then calls model.CheckBlockIdMetadataAccessableByPublishAccess or model.CheckBlockIdMetadataAccessableByPublishAccessInBox for ID-based lookups, and introduces new filtering functions (filterFileTreePathsByPublishMetadataAccess, filterFileTreeBlockIDsByPublishDiscoverability) for path-based and ID-list lookups. These additions ensure that only authorized metadata is returned. Therefore, the identified vulnerable functions are precisely these five API endpoints, as they were the ones directly modified to include the missing authorization logic.
