CVE-2026-87815: SiYuan Path Traversal Vulnerability

CVE-2026-87815 Overview

CVE-2026-87815 is a path traversal vulnerability in SiYuan, an open-source personal knowledge management application. The flaw exists in the /api/riff/removeRiffDeck endpoint, which fails to validate the deckID parameter before constructing a file path for deletion. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory. The issue affects all SiYuan releases prior to v3.8.2 and is tracked as [CWE-73: External Control of File Name or Path].

Critical Impact
Authenticated administrators can delete arbitrary .deck and .cards files anywhere the SiYuan process has write access, enabling data destruction and integrity loss outside the workspace boundary.

Affected Products

SiYuan versions prior to v3.8.2
SiYuan self-hosted deployments exposing the /api/riff/removeRiffDeck API
SiYuan desktop and server installations that permit authenticated administrator access

Discovery Timeline

2026-09-09 - CVE-2026-87815 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87815

Vulnerability Analysis

The vulnerability resides in SiYuan's flashcard (riff) subsystem. The /api/riff/removeRiffDeck endpoint accepts a deckID parameter from the client and uses it directly to construct the target file path for deletion. Because the handler does not validate or normalize the input, sequences such as ../ are honored during path resolution.

An authenticated administrator can craft a deckID value containing traversal segments to reference files outside the intended workspace directory. When the server processes the request, it deletes the resolved .deck and .cards files. This produces integrity and availability impact against files the SiYuan process can write. See the GitHub Security Advisory GHSA-94vh-rpgr-rpwc and the VulnCheck Path Traversal Advisory for advisory context.

Root Cause

The root cause is missing input validation on the deckID parameter [CWE-73]. The endpoint trusts client-supplied data when building a filesystem path and does not enforce that the resolved path remains within the workspace directory. No canonicalization or allow-list check is applied before the delete operation.

Attack Vector

Exploitation requires network access to the SiYuan API and valid administrator credentials. An attacker sends a POST request to /api/riff/removeRiffDeck with a deckID value containing ../ sequences that resolve to a target directory outside the workspace. The server then deletes any matching .deck and .cards files at the resolved location. No user interaction is required beyond authentication.

No verified public proof-of-concept code is available. Refer to the vendor advisory for technical detail.

Detection Methods for CVE-2026-87815

Indicators of Compromise

HTTP requests to /api/riff/removeRiffDeck containing .., %2e%2e, or URL-encoded traversal sequences in the deckID field.
Unexpected deletion of .deck or .cards files outside the configured SiYuan workspace directory.
Administrator-authenticated API calls originating from unusual IP addresses or user agents.

Detection Strategies

Inspect SiYuan access logs for POST requests to the /api/riff/removeRiffDeck endpoint and flag payloads whose deckID value contains traversal metacharacters.
Deploy web application firewall rules that block path traversal patterns in JSON request bodies targeting the SiYuan API.
Enable filesystem auditing on directories adjacent to the SiYuan workspace to catch unauthorized deletions of .deck and .cards artifacts.

Monitoring Recommendations

Alert on administrator session activity that issues delete-oriented API calls at abnormal volume or off-hours.
Monitor file integrity across the workspace and parent directories using host-based tooling.
Track SiYuan version strings in inventory data to identify hosts running releases prior to v3.8.2.

How to Mitigate CVE-2026-87815

Immediate Actions Required

Upgrade SiYuan to v3.8.2 or later on all deployments.
Rotate administrator credentials if the API was exposed to untrusted networks prior to patching.
Restrict network reachability of the SiYuan API to trusted management ranges until upgrade is complete.

Patch Information

The SiYuan maintainers addressed CVE-2026-87815 in release v3.8.2 by validating the deckID parameter in the /api/riff/removeRiffDeck handler. Consult the GitHub Security Advisory GHSA-94vh-rpgr-rpwc for release details and upgrade guidance.

Workarounds

Block external access to /api/riff/removeRiffDeck at a reverse proxy or WAF until upgrade is completed.
Limit administrator accounts and audit existing sessions to reduce the population that can invoke the vulnerable endpoint.
Run the SiYuan process under a least-privilege service account that cannot write to sensitive directories outside its workspace.

bash

# Example reverse proxy rule to block traversal payloads to the vulnerable endpoint
location /api/riff/removeRiffDeck {
    if ($request_body ~* "\.\./|%2e%2e") {
        return 403;
    }
    proxy_pass http://siyuan_backend;
}