The CVSS 5.3 assigned to this path disclosure in SiYuan is a misleading metric that measures the wrong thing. The vulnerability sits at the intersection of three design choices that individually seem benign but together create a serious reconnaissance oracle — and CVSS has no mechanism to weight interaction effects.
The resolveAssetPath endpoint returns absolute filesystem paths to requests that only pass CheckAuth — a thin authentication layer that many legitimate client components trigger automatically. RSS feed refreshes, plugin initialization, and cross-document links all cause the endpoint to fire without user interaction. This means the attack surface isn't limited to adversarial probing; it's passively exercised by normal usage patterns.
What makes this critical rather than medium is what the path enables. An absolute path containing the OS username eliminates the need to guess host configuration — attackers move straight to targeting the correct user context. The workspace path additionally reveals deployment topology: Docker container paths, Linux distribution packaging conventions, or Windows user folder isolation patterns. These details directly inform privilege escalation vectors and lateral movement strategies that a 5.3 score would never suggest.
The publication model completes the chain. Published documents expose relative asset paths that can be harvested en masse, then submitted to resolveAssetPath to map to absolute locations. This three-step reconnaissance loop requires only CheckAuth-level access and leaves no detection footprint — there's no crash, no anomaly log, no alert that the endpoint was just used for filesystem mapping.
There's an additional dimension that CVSS cannot capture: SiYuan runs on personal workstations, researcher laptops, and executive machines. The disclosed path doesn't lead to abstract server infrastructure — it leads to someone's private thought archive. Unpublished manuscripts, strategic planning, credential drafts, the intellectual residue of a journalist's sources or a researcher's findings. The blast radius is measured in personal exposure, not server compromise, and the same 5.3 that feels reasonable for a corporate API fundamentally misjudges a tool where someone writes their resignation letter or negotiates a merger.
The fix isn't simply restricting the endpoint — it's replacing the returned path with a content-addressable identifier (a hash or UUID that resolves server-side) so the underlying filesystem structure is never exposed. But given the current scoring, this will likely remain unfixed "next sprint" while the endpoint continues functioning as a passive reconnaissance asset. The CVSS score gives organizations permission to deprioritize exactly the class of vulnerability that historically chains into remote code execution — and this one sits on personal machines containing the most sensitive data many users have.