Which versions of SiYuan are affected by CVE-2026-87815?

SiYuan's flashcard management API contains a path traversal vulnerability enabling authenticated administrators to delete arbitrary files anywhere on the hosting server, not merely within the…. A patch is available.

How to fix or mitigate CVE-2026-87815?

Within 24 hours, apply the available vendor patch to all SiYuan deployments and verify successful installation. Within 7 days, review system and application deletion logs for the vulnerability window to identify any suspicious file removal patterns, and conduct an audit of all administrator account activity during this period. Within 30 days, implement operating-system level access controls to restrict the SiYuan process to only required directories, conduct a full filesystem integrity check of critical system areas, and establish monitoring for suspicious file operations by SiYuan.

SiYuan CVE-2026-87815

Q: What is the CVSS score of CVE-2026-87815?

CVE-2026-87815 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-74841 HIGH

External Control of File Name or Path (CWE-73)

2026-09-09 VulnCheck

GHSA-h9g5-83g6-g5ch

Path Traversal Siyuan Siyuan Note

8.4

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.7 HIGH

Network API requires admin auth (PR:H); scope changes because deletion reaches outside workspace (S:C); no confidentiality impact, only destructive file deletion (C:N/I:H/A:H).

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 09, 2026 - 19:29 vuln.today

Analysis Generated

Sep 09, 2026 - 12:05 vuln.today

Patch available

Sep 09, 2026 - 12:03 EUVD

CVE Published

Sep 09, 2026 - 11:21 cve.org

HIGH 8.4

DescriptionCVE.org

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory.

AnalysisAI

Path traversal in SiYuan's flashcard deck management API allows an authenticated administrator to delete arbitrary .deck and .cards files anywhere on the host filesystem. The /api/riff/removeRiffDeck endpoint accepts a deckID parameter without sanitizing traversal sequences, so a malicious or compromised admin account can reference files outside the designated workspace directory. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated administrator session on the SiYuan application - PR:H per the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) indicates network-accessible exploitation with no special conditions but requires high-privilege (administrator) credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to SiYuan v3.8.2 or later, which is the vendor-released patch per the GitHub security advisory GHSA-94vh-rpgr-rpwc. … Detailed patch versions, workarounds, and compensating controls in full report.