Path Traversal Vulnerability in SiYuan Product by SiYuan
CVE-2026-87815

8.4HIGH

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
9 September 2026

What is CVE-2026-87815?

SiYuan versions prior to v3.8.2 are vulnerable to a path traversal exploit in the /api/riff/removeRiffDeck endpoint. The flaw arises from a lack of validation for the deckID parameter, allowing an authenticated administrator to introduce path traversal sequences. This can lead to unauthorized deletion of .deck and .cards files located outside the designated workspace directory, posing significant risks to data integrity.

Affected Version(s)

siyuan 0 < 3.8.2

siyuan 3.8.2

References

https://github.com/siyuan-note/siyuan/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/siyuan-before-3.8.2-...
third-party-advisory

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
.