CVE-2026-87815

SiYuan before v3.8.2 Path Traversal via removeRiffDeck

8.4 High

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: High

Exploit likelihood

0.48%Up 0.2 points since Sep 10, 2026

What each source reports

CVE List Score used 8.4

SiYuan before v3.8.2 Path Traversal via removeRiffDeck

Record: CVE-2026-87815
CVSS 4.0: 8.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
CVSS 3.1: 8.7 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Weakness: CWE-73
Updated: 2026-11-02

EUVDEUVD-2026-74841 8.4

Record: EUVD-2026-74841
CVSS 4.0: 8.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-h9g5-83g6-g5ch 8.4

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff...

Record: GHSA-h9g5-83g6-g5ch
CVSS 4.0: 8.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.7 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Weakness: CWE-73
Updated: 2026-11-02

NVD 8.4

Record: CVE-2026-87815
CVSS 4.0: 8.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.7 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Weakness: CWE-73
Updated: 2026-11-02

OSV 8.4

SiYuan before v3.8.2 Path Traversal via removeRiffDeck

Record: CVE-2026-87815
CVSS 4.0: 8.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
Weakness: CWE-73
Updated: 2026-11-02

Affected products

siyuan-note siyuan

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-87815 is a high vulnerability (CVSS 8.4) in Siyuan-note Siyuan, published September 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. No source names a fixed version.