Executive brief
SiYuan is a note-taking and knowledge management application. An authenticated administrator can exploit a path traversal flaw in the flashcard deck deletion endpoint to delete arbitrary files ending in .deck or .cards anywhere on the filesystem, potentially destroying flashcard data in other workspaces on shared hosts and compromising the availability and integrity of user data.
Technical details
The /api/riff/removeRiffDeck endpoint in SiYuan's kernel/api/riff.go fails to validate the deckID parameter before passing it to model.RemoveDeck, which uses filepath.Join to construct a filesystem path for deletion. An authenticated administrator can supply path traversal sequences (e.g., "../../../../tmp/victim") to escape the workspace directory and delete arbitrary files matching *.deck or *.cards patterns outside the intended riff storage directory. The vulnerability stems from missing ast.IsNodeIDPattern or IsSubPath validation that sibling components like the attribute-view subsystem implement. The attack requires admin authentication but no user interaction, and affects scope beyond the application's intended workspace boundary (CVSS Scope Changed). The fix is available in v3.8.2, which adds proper ID validation.
Affected products
- SiYuan SiYuan before v3.8.2
Timeline
- 2026-09-09: disclosed: CVE-2026-87815 published
- 2026-08-26: patched: Fix released in v3.8.2