What is CVE-2026-60084?

CVE-2026-60084 is a high-severity vulnerability in Siyuan-Note Siyuan, classified under Path Traversal. CVSS score: 8.7/10. Published 2026-08-22.

How severe is CVE-2026-60084?

High severity. CVSS v3 base score is 8.7 out of 10.

Path Traversal in Siyuan-Note Siyuan

CVE-2026-60084

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file or directory the kernel process has permission to remove, anywhere on the host filesystem.

Vulnerability class: Path Traversal (Directory Traversal)

CVSS v3 metric

CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H.

Affected products

Siyuan-note Siyuan

Weakness classification (CWE)

CWE-22 — Path Traversal

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-60084?: CVE-2026-60084 is a high-severity vulnerability in Siyuan-Note Siyuan, classified under Path Traversal. CVSS score: 8.7/10. Published 2026-08-22.
How severe is CVE-2026-60084?: High severity. CVSS v3 base score is 8.7 out of 10.