High severity · published Sep 9, 2026
CVE-2026-87815
SiYuan before v3.8.2 Path Traversal via removeRiffDeck
8.7
CVSS
0.5%
EPSS
No
On KEV
Description
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
siyuan · siyuan-note
before 3.8.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-87815
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-87815
github.com
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-94vh-rpgr-rpwc
www.vulncheck.com
https://www.vulncheck.com/advisories/siyuan-before-3.8.2-path-traversal-via-removeriffdeck
More from siyuan
10.0
CVE-2026-72811
SiYuan before v3.7.4 SQL Injection via backlink search
10.0
CVE-2026-69085
SiYuan before v3.7.3 SQL Injection via searchDocs
10.0
CVE-2026-69084
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
10.0
CVE-2026-69083
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
10.0
CVE-2026-66012
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP