Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck
CVE-2026-87815SiYuan before v3.8.2 Path Traversal via removeRiffDeck
High 8.7
In plain English
A high-severity security flaw in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)8.7High
Exploit odds (30 days)0.5%top 58.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| siyuan-note | siyuan | 0 – before 3.8.2 |
Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
References
- GitHub Security Advisory (GHSA-94vh-rpgr-rpwc) vendor-advisory
- VulnCheck Advisory: SiYuan before v3.8.2 Path Traversal via removeRiffDeck third-party-advisory