GHSA-FGMR-7W36-9QFQ SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers

CVE: This vulnerability corresponds to CVE-2026-72796. Summary Several static-file routes in the server mux kernel/server/serve.go are registered with CheckAuth only and serve directories directly, without the publish-access checks, sensitive-path blocklist, or refuseToAccess rules that the REST...