CVE-2026-87815 siyuan-note CVE debrief

Who should care

Defenders responsible for SiYuan deployments should assess exposure and prioritize patching, as an authenticated administrator can exploit this vulnerability to delete arbitrary files.

Why it matters

CVE-2026-87815 is a high-severity vulnerability in SiYuan versions before v3.8.2 that allows authenticated administrators to delete arbitrary files. Defenders should prioritize verifying and applying the patch, restricting access to the vulnerable endpoint, and monitoring for suspicious activity.

• Verify patch application to prevent arbitrary file deletion
• Restrict access to the /api/riff/removeRiffDeck endpoint to prevent exploitation
• Monitor for suspicious activity related to file deletion

Technical summary

The /api/riff/removeRiffDeck endpoint in SiYuan versions before v3.8.2 is vulnerable to path traversal attacks. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory. This issue allows for the deletion of files outside the intended workspace directory, potentially leading to data loss or system compromise. Defenders should prioritize verifying and applying the patch for SiYuan versions before v3.8.2, as an authenticated administrator can exploit this vulnerability to delete arbitrary files.

Defensive priority

Defenders should prioritize verifying and applying the patch for SiYuan versions before v3.8.2, as an authenticated administrator can exploit this vulnerability to delete arbitrary files.

Recommended defensive actions

• Verify and apply the patch for SiYuan versions before v3.8.2
• Restrict access to the /api/riff/removeRiffDeck endpoint
• Monitor for suspicious activity related to file deletion
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page provide information on the path traversal vulnerability in SiYuan versions before v3.8.2. The vulnerability is in the /api/riff/removeRiffDeck endpoint and allows an authenticated administrator to delete arbitrary .deck and .cards files.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.