CVE-2026-60084: SiYuan Path Traversal Vulnerability

CVE-2026-60084 Overview

CVE-2026-60084 is an arbitrary file deletion vulnerability in SiYuan versions before v3.7.4. The flaw exists in the /api/search/removeTemplate endpoint, which accepts an unvalidated path parameter and passes it directly to os.RemoveAll. Authenticated administrators can supply absolute filesystem paths to recursively delete any file or directory the kernel process has permission to remove. The issue is tracked as a path traversal weakness under [CWE-22].

Critical Impact
Attackers with admin credentials can recursively destroy arbitrary files anywhere on the host filesystem, causing data loss and potential denial of service against the SiYuan application and the underlying host.

Affected Products

SiYuan note-taking application versions before v3.7.4
Self-hosted SiYuan kernel instances exposing the HTTP API
Deployments where the kernel process runs with elevated filesystem permissions

Discovery Timeline

2026-08-22 - CVE-2026-60084 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-60084

Vulnerability Analysis

SiYuan is an open-source personal knowledge management application built in Go. The kernel component exposes an HTTP API that includes /api/search/removeTemplate, an endpoint intended to delete template files from the user's data directory. The handler accepts a path parameter from the request body and forwards it, without sanitization or validation, to the Go standard library function os.RemoveAll.

os.RemoveAll performs recursive deletion of the target path and any children. Because the endpoint does not confirm that the supplied path resides within the templates directory, an attacker can submit an absolute path pointing anywhere on the filesystem. The kernel process then removes the target as long as the operating system permits it.

Exploitation requires an authenticated administrator session. In single-user or self-hosted deployments where the API token is reused, shared, or leaked, this bar is low. On multi-user or exposed installations, the vulnerability enables privileged users to destroy files unrelated to SiYuan.

Root Cause

The root cause is missing input validation on a user-controlled filesystem path [CWE-22]. The handler treats the path value as trusted and does not enforce a canonicalized prefix check against the templates directory. There is no allowlist, no traversal sequence rejection, and no confinement to a base directory before invoking os.RemoveAll.

Attack Vector

The attack is delivered over the network to the SiYuan kernel HTTP API. An authenticated administrator issues a POST request to /api/search/removeTemplate with a JSON body containing an absolute path such as a system configuration directory or a database file. The kernel recursively deletes the target. See the GitHub Security Advisory GHSA-w938-w7m4-qrj8 and the VulnCheck Advisory on SiYuan for technical details.

Detection Methods for CVE-2026-60084

Indicators of Compromise

POST requests to /api/search/removeTemplate containing absolute filesystem paths or path traversal sequences such as ../
Unexpected deletion of files or directories owned by the account running the SiYuan kernel
SiYuan kernel logs referencing os.RemoveAll operations against paths outside the configured data directory
Sudden application errors, missing configuration files, or service failures on hosts running SiYuan

Detection Strategies

Inspect reverse proxy and web server logs for requests to the removeTemplate API and correlate them with the authenticated admin session identifier
Alert on file deletion telemetry on the SiYuan host, particularly deletions outside the SiYuan data directory initiated by the kernel process
Monitor process-level file operations using endpoint telemetry to correlate unlink and directory removal syscalls with the SiYuan binary

Monitoring Recommendations

Enable HTTP request body logging on the SiYuan API and forward events to a central SIEM for retention and search
Baseline normal template management activity so that deletions targeting paths outside data/templates generate alerts
Track admin authentication events and API token usage for anomalies that precede destructive API calls

How to Mitigate CVE-2026-60084

Immediate Actions Required

Upgrade SiYuan to version v3.7.4 or later, which contains the fix for CVE-2026-60084
Rotate SiYuan API tokens and administrator credentials after upgrading
Restrict network exposure of the SiYuan kernel API to trusted networks or authenticated reverse proxies
Run the SiYuan kernel as an unprivileged user with filesystem access limited to its data directory

Patch Information

The maintainers addressed the flaw in SiYuan v3.7.4. The fix validates the path parameter and confines deletion to the templates directory before invoking os.RemoveAll. Refer to the GitHub Security Advisory GHSA-w938-w7m4-qrj8 for release details.

Workarounds

Place the SiYuan API behind a reverse proxy that blocks requests to /api/search/removeTemplate until patching is complete
Run SiYuan inside a container or sandbox with a read-only root filesystem and a bind-mounted data directory
Apply mandatory access controls such as AppArmor or SELinux profiles that limit deletion to the SiYuan data path

bash

# Example nginx rule to block the vulnerable endpoint pre-patch
location = /api/search/removeTemplate {
    return 403;
}