CVE-2026-60084 in SiYuan
Summary
by MITRE • 08/22/2026
SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file or directory the kernel process has permission to remove, anywhere on the host filesystem.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The SiYuan note-taking application, prior to version 3.7.4, contains a critical arbitrary file deletion vulnerability within its API layer, specifically affecting the /api/search/removeTemplate endpoint. This flaw stems from an improper validation of user-supplied input before it is processed by the underlying operating system functions. The vulnerability allows for significant data integrity compromise and potential denial of service conditions if exploited effectively against administrative accounts.
The technical root cause lies in how the application handles path parameters passed to the os.RemoveAll function, which is a Go standard library routine used to remove files or directories recursively. When an authenticated administrator interacts with this endpoint, the system fails to sanitize or validate the provided file path argument. Instead of restricting operations to expected template directories within the SiYuan data structure, the application passes the raw input directly to the operating system's removal mechanism without checking for directory traversal sequences such as ../ or ensuring the target resides within a permitted sandboxed area.
This lack of validation enables an authenticated attacker with administrative privileges to specify absolute filesystem paths on the host machine. By supplying these arbitrary paths, the attacker can instruct the application kernel process to delete any file or directory that the executing user account has permission to remove. This capability extends far beyond the intended scope of managing search templates, effectively granting the ability to wipe critical system files, configuration data, or other sensitive documents stored on the host server.
The operational impact of this vulnerability is severe due to its potential for widespread data loss and service disruption. An attacker can recursively delete essential application components, leading to a complete denial of service as SiYuan may fail to start or function correctly without core files. Furthermore, if critical system configurations or other user data are inadvertently targeted, the consequences could include permanent loss of information that cannot be easily recovered from backups. The ability to target arbitrary paths means the scope of damage is limited only by the permissions granted to the process running SiYuan, which often includes read and write access to significant portions of the file system in typical deployment scenarios.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The failure to restrict input to a specific safe location allows for unauthorized access and modification of resources outside the intended context. Additionally, because exploitation requires authentication, it relates to CWE-798: Use of Hard-coded Credentials if weak admin credentials are present, but primarily represents an authorization bypass where valid privileges are abused through insufficient input validation rather than privilege escalation per se. In terms of attack vectors, this falls under ATT&CK technique T1083: File and Directory Discovery or more accurately T1485: Data Destruction, as the primary intent and outcome involve the deletion of data to impact availability and integrity.
Mitigation strategies must focus on immediate patching and defensive coding practices. The most effective remediation is upgrading SiYuan to version 3.7.4 or later, where this input validation flaw has been addressed by developers. For environments unable to upgrade immediately, implementing a web application firewall with rules that detect and block requests containing path traversal sequences in API parameters can provide temporary protection. Additionally, running the SiYuan service under a restricted user account with minimal file system permissions limits the blast radius of such an exploit, ensuring that even if arbitrary deletion occurs, it is confined to non-critical directories. Regular audits of input validation logic across all API endpoints are recommended to prevent similar vulnerabilities in other parts of the application.