High severity · published Aug 22, 2026
CVE-2026-60084
SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file or directory the kernel process has permission to remove, anywhere on the host filesystem.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
siyuan · siyuan-note
before 3.7.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-60084
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-60084
github.com
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w938-w7m4-qrj8
www.vulncheck.com
https://www.vulncheck.com/advisories/siyuan-before-arbitrary-file-deletion-via-removetemplate
More from siyuan
10.0
CVE-2026-72811
SiYuan before v3.7.4 SQL Injection via backlink search
10.0
CVE-2026-69085
SiYuan before v3.7.3 SQL Injection via searchDocs
10.0
CVE-2026-69084
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
10.0
CVE-2026-69083
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
10.0
CVE-2026-66012
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP