SiYuan CVE-2026-60084

Exploitation requires valid SiYuan administrator credentials - confirmed by the CVSS PR:H metric. The attacker must reach the SiYuan backend HTTP API (default behavior is LAN/localhost exposure, not public internet), authenticate successfully, and supply an arbitrary absolute filesystem path as the template path parameter to /api/search/removeTemplate. What limits exploitation: (1) admin-level authentication is mandatory, ruling out unauthenticated or low-privilege attacks; (2) impact is bounded by the OS-level permissions of the SiYuan kernel process - a least-privilege process account restricts reachable filesystem paths; (3) SiYuan is typically deployed as a local or LAN-only tool, reducing external network exposure. No special non-default configuration is required for the vulnerability itself - any standard SiYuan deployment with the API accessible is susceptible once admin credentials are obtained.

The CVSS 4.0 score of 8.4 (AV:N/AC:L/AT:N/PR:H/UI:N) reflects a real but constrained threat: exploitation requires valid admin-level credentials, which limits the attacker population to insiders, credential-theft scenarios, or compromised sessions. The score is elevated by severe integrity and availability impacts on both the vulnerable system (VI:H/VA:H) and subsequent systems (SI:H/SA:H) - the latter is realistic when SiYuan runs on a shared server where the kernel process has broad filesystem rights, enabling deletion of OS-critical or shared-storage paths. EPSS data was not provided in the input, so exploitation probability cannot be quantified. No CISA KEV listing and no public POC exist at time of analysis, indicating low opportunistic risk. The downstream scope change signals may be overstated for isolated single-user desktop deployments where the kernel process is OS-user-confined; organizations running SiYuan as a multi-user or server-hosted instance should treat this as higher priority. Active exploitation is unconfirmed - this is a real-world priority driven by insider threat and credential-compromise scenarios, not mass scanning.

An attacker who has obtained SiYuan administrator credentials - through phishing, credential reuse, or insider access - authenticates to the SiYuan HTTP API and submits a POST request to /api/search/removeTemplate with a path parameter set to a critical absolute filesystem path such as /etc or the application's data root. The SiYuan kernel calls os.RemoveAll on that path without validation, recursively and permanently deleting the target. No public exploit code has been identified, but the attack requires only standard HTTP tooling and valid admin credentials.