01 Record

CVE-2026-60084

SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate

HighPUBLISHEDCNA: VulnCheck

Base score8.4 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

02 Description

SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplate

Published

2026-08-22 12:26Z2 HR AGO

Last updated

2026-08-22 12:26Z2 HR AGO

Reserved

2026-07-08

Assigning CNA

VulnCheck

Record state

PUBLISHED

Severity

High (CVSS 8.4)

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

Weaknesses

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Base

SSVC decision

No CISA-ADP assessment

Data version

5.2

Document digest

942ff4484f316724e2d50a81a37c7b15bd5442d712417012aa56c3b1eab2851c

VendorProductVersionsPlatforms

siyuan-notesiyuan0 to < 3.7.4—

github.comGitHub Security Advisory (GHSA-w938-w7m4-qrj8)https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w938-w7m4-qrj8vendor-advisory
www.vulncheck.comVulnCheck Advisory: SiYuan before v3.7.4 Arbitrary File Deletion via removeTemplatehttps://www.vulncheck.com/advisories/siyuan-before-arbitrary-file-deletion-via-removetemplatethird-party-advisory