CVE-2026-60084 siyuan-note CVE debrief

Who should care

System administrators and defenders responsible for SiYuan installations, especially those with admin access, should assess exposure and prioritize remediation. This includes reviewing the current SiYuan version, restricting access to the /api/search/removeTemplate endpoint, and monitoring for suspicious activity related to file deletion. Additionally, defenders should consider the potential operational impacts of this vulnerability, including potential

Why it matters

CVE-2026-60084 is a high-severity vulnerability in SiYuan that allows authenticated admin attackers to delete arbitrary files or directories. Defenders should prioritize verifying and remediating this vulnerability, especially in systems where admin access is sensitive.

• Potential data loss or corruption due to arbitrary file deletion
• Possible disruption of system functionality or services
• Increased risk of privilege escalation or lateral movement
• Need for verification of SiYuan version and endpoint access controls

Technical summary

The /api/search/removeTemplate endpoint in SiYuan versions before v3.7.4 accepts an unvalidated path parameter, allowing authenticated admin attackers to delete arbitrary files or directories on the host filesystem. This vulnerability has significant technical implications, as it could lead to potential data loss or corruption, disruption of system functionality or services, and increased risk of privilege escalation or lateral movement. Defenders should prioritize verifying and remediating this vulnerability, especially in systems where admin access is sensitive.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in systems where admin access is sensitive.

Recommended defensive actions

• Verify SiYuan version and upgrade to v3.7.4 or later if necessary
• Restrict access to the /api/search/removeTemplate endpoint
• Monitor for suspicious activity related to file deletion
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE record and NVD entry. The /api/search/removeTemplate endpoint accepts an unvalidated path parameter, allowing for arbitrary file deletion. Defenders should verify the SiYuan version, assess exposure, and prioritize remediation, especially in systems where admin access is sensitive. Evidence is limited to public CVE and NVD records; further verification tasks are recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.