CVE-2026-87815 SiYuan before v3.8.2 Path Traversal via removeRiffDeck
An authenticated administrator can exploit a path traversal flaw to delete arbitrary files outside the workspace directory.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-87815?
CVE-2026-87815 is a high-severity path traversal vulnerability in siyuan-note siyuan, published on 9 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory.
Weakness: CWE-73
Which versions are affected by CVE-2026-87815?
How do I fix CVE-2026-87815?
No fix has been published for CVE-2026-87815 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-87815 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-87815 exists.
Sources
Also known as GHSA-94vh-rpgr-rpwc, GHSA-h9g5-83g6-g5ch.