SiYuan CVE-2026-87815

Exploitation requires an authenticated administrator session on the SiYuan application - PR:H per the CVSS 4.0 vector. The SiYuan API must be network-accessible (AV:N), meaning the instance must not be restricted to loopback-only access. The vulnerability is in the flashcard/riff feature's deck removal endpoint, so the riff/flashcard functionality must be present (it is part of the standard SiYuan installation). No special configuration beyond having an admin account is required. Limiting factors include: the admin credential requirement eliminates unauthenticated external attackers; deletion is constrained to .deck and .cards file extensions per the description; and damage scope depends on what files with those extensions exist on the host outside the workspace.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) indicates network-accessible exploitation with no special conditions but requires high-privilege (administrator) credentials. This substantially limits the realistic attacker pool to insiders, compromised admin accounts, or scenarios where the SiYuan web server is exposed with weak admin credentials. The subsequent-system impacts SI:H/SA:H confirm that harm can reach the underlying host filesystem, not just the application workspace - a meaningful escalation of destructive capability. EPSS data is not present in the provided intelligence, and the CVE is not listed in CISA KEV. No public exploit code has been identified. Real-world risk is therefore moderate: the file-deletion primitive is destructive but constrained by the PR:H requirement and the limited file-type targeting (.deck and .cards extensions only, per the description). Organizations running SiYuan with its web interface exposed on non-loopback interfaces should treat this as a priority fix given the potential for host-level file destruction.

An attacker with administrator access to a network-exposed SiYuan instance sends a crafted POST request to /api/riff/removeRiffDeck with the deckID parameter set to a path traversal sequence such as ../../../../etc/important-file. The application resolves the path outside the workspace and deletes the targeted file as the SiYuan process user. No public proof-of-concept has been identified, but the exploit pattern is straightforward given the absence of input validation described in the advisory.