CVE-2026-87815 in SiYuan
Summary
by MITRE • 09/09/2026
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The SiYuan note-taking application, prior to version 3.8.2, contains a critical path traversal vulnerability within its API endpoint responsible for managing riff decks. This specific flaw is located in the /api/riff/removeRiffDeck function, which handles requests to delete deck configurations and associated card data. The root cause of this vulnerability lies in the insufficient validation of the deckID parameter provided by the client during HTTP POST or DELETE operations. Instead of strictly validating that the input corresponds only to valid identifiers within the expected workspace directory structure, the application processes raw user-supplied strings containing path traversal sequences such as dot-dot-slash (../) without proper sanitization or canonicalization checks.
This lack of input validation allows an authenticated administrator to manipulate file system paths beyond their intended scope. By injecting relative path navigation characters into the deckID field, an attacker can redirect the deletion operation away from the designated workspace directory and target arbitrary locations on the underlying operating system's file structure. The operational impact is severe because the application executes these deletions with the privileges of the running process, which typically has read-write access to the SiYuan data directories. Consequently, this vulnerability enables the unauthorized modification or destruction of critical configuration files, potentially leading to denial of service conditions where the application becomes unstable or unresponsive due to missing essential components.
From a security classification perspective, this issue aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The ability to access and delete files outside the restricted directory violates the principle of least privilege and proper isolation boundaries defined in secure coding standards. Furthermore, because the vulnerability requires authentication but allows an administrator-level user to cause significant damage through file system manipulation, it also relates to CWE-269: Improper Privilege Management if the administrative role is not strictly bounded by functional necessity. In terms of attack vectors, this falls under ATT&CK technique T1083: File and Directory Discovery or more specifically T1485: Data Destruction, as the primary outcome involves the intentional deletion of data to disrupt operations or erase evidence.
The severity of this vulnerability is amplified by the fact that it targets an administrative endpoint. While authentication provides a baseline level of access control, relying solely on role-based permissions without rigorous input validation leaves the system vulnerable to insider threats or compromised admin accounts. An attacker who gains administrator credentials can exploit this flaw not only to delete specific deck files but potentially to remove other critical configuration files if they can guess or discover their paths through subsequent reconnaissance using similar traversal techniques. This could lead to a complete compromise of data integrity and availability for all users relying on the SiYuan instance.
To mitigate this vulnerability, immediate action is required by upgrading the SiYuan installation to version 3.8.2 or later, where the developers have implemented proper input validation mechanisms. For environments that cannot be upgraded immediately, a temporary mitigation involves implementing strict allow-listing for the deckID parameter at the web application firewall level or within reverse proxy configurations. This should ensure that only alphanumeric characters and specific safe delimiters are accepted, effectively blocking any path traversal sequences before they reach the application logic. Additionally, administrators should review access logs to identify any suspicious requests containing dot-dot-slash patterns targeting this endpoint, which may indicate active exploitation attempts. Regular audits of file system permissions and ensuring that the SiYuan process runs with minimal necessary privileges can further reduce the blast radius in case of future vulnerabilities.