CVE-2026-60084
Received Received - Intake

SiYuan Arbitrary File Deletion Vulnerability Before v3.7.4

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: VulnCheck

Description
SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file or directory the kernel process has permission to remove, anywhere on the host filesystem.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-60084
EUVD
EUVD-2026-64269

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects SiYuan versions before v3.7.4. It allows authenticated admin attackers to delete any file or directory on the host filesystem by supplying absolute paths to the /api/search/removeTemplate endpoint. The issue occurs because the path parameter is passed directly to os.RemoveAll without validation, enabling recursive deletion of files the application has permission to access.

Detection Guidance

Check SiYuan logs for suspicious /api/search/removeTemplate requests with absolute paths. Monitor filesystem deletions in real-time using tools like auditd or sysmon. Inspect network traffic for admin API calls targeting the vulnerable endpoint.

Impact Analysis

An attacker with admin access could delete critical system files, application data, or user files, leading to data loss, system instability, or denial of service. The vulnerability allows complete compromise of file integrity and availability on the affected host.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (health data security) by enabling unauthorized deletion or destruction of sensitive data. Organizations may face penalties for failing to protect personal or health information due to inadequate security controls.

Mitigation Strategies

Upgrade SiYuan to v3.7.4 or later. Restrict admin access to the application. Implement network-level controls to block unauthorized API calls to /api/search/removeTemplate. Review and revoke any suspicious admin sessions or plugins.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-60084. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart