CVE-2026-60084

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file or directory the kernel process has permission to remove, anywhere on the host filesystem.

CVSS v3 8.7 HIGH

8.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w938-w7m4-qrj8
https://www.vulncheck.com/advisories/siyuan-before-arbitrary-file-deletion-via-removetemplate
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w938-w7m4-qrj8

Configurations

No configuration.

History

12 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de SiYuan anteriores a la v3.7.4 contienen una vulnerabilidad de eliminación arbitraria de archivos en el endpoint /api/search/removeTemplate que acepta un parámetro de ruta no validado pasado directamente a os.RemoveAll. Atacantes administradores autenticados pueden proporcionar rutas de sistema de archivos absolutas para eliminar recursivamente cualquier archivo o directorio que el proceso del kernel tenga permiso para eliminar, en cualquier lugar del sistema de archivos del host.

Information

Published : 2026-08-22 13:16

Updated : 2026-10-12 16:10

NVD link : CVE-2026-60084

Mitre link : CVE-2026-60084

CVE.ORG link : CVE-2026-60084

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-60084", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-60084", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T19:21:57.161119Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 5.8, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "siyuan-note", "product": "siyuan", "versions": [{"status": "affected", "version": "0", "lessThan": "3.7.4", "versionType": "semver"}, {"status": "unaffected", "version": "3.7.4", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/siyuan-note/siyuan/kernel", "defaultStatus": "unaffected"}]}], "published": "2026-08-22T13:16:39.407", "references": [{"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w938-w7m4-qrj8", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/siyuan-before-arbitrary-file-deletion-via-removetemplate", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w938-w7m4-qrj8", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file or directory the kernel process has permission to remove, anywhere on the host filesystem."}, {"lang": "es", "value": "Las versiones de SiYuan anteriores a la v3.7.4 contienen una vulnerabilidad de eliminaci\u00f3n arbitraria de archivos en el endpoint /api/search/removeTemplate que acepta un par\u00e1metro de ruta no validado pasado directamente a os.RemoveAll. Atacantes administradores autenticados pueden proporcionar rutas de sistema de archivos absolutas para eliminar recursivamente cualquier archivo o directorio que el proceso del kernel tenga permiso para eliminar, en cualquier lugar del sistema de archivos del host."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "disclosure@vulncheck.com"}