CVE-2026-60084 SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate
Authenticated admin attackers can delete arbitrary files on the host via path traversal in the removeTemplate API endpoint.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-60084?
CVE-2026-60084 is a high-severity path traversal vulnerability in siyuan-note siyuan, published on 22 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file or directory the kernel process has permission to remove, anywhere on the host filesystem.
Weakness: CWE-22
Which versions are affected by CVE-2026-60084?
How do I fix CVE-2026-60084?
No fix has been published for CVE-2026-60084 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-60084 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-60084 exists.
Sources
Also known as GHSA-f62p-x567-xj6g.