Vulnerability details

CVE-2026-60084

siyuan-note siyuan

SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate

CVSS 4.0

8.4High

Official description

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file or directory the kernel process has permission to remove, anywhere on the host filesystem.

CVSS scores

Score	Version	Source	Vector
8.4High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H`
8.7High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
siyuan-note	siyuan	v < 3.7.4	CVEProject cvelistV5 (CNA)

References and advisories

https://www.vulncheck.com/advisories/siyuan-before-arbitrary-file-deletion-via-removetemplate third-party-advisory
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w938-w7m4-qrj8 vendor-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-08-22
Last updated: 2026-08-24
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.39%

Probability of exploitation in 30 days

34%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')