CVE-2026-87815

8.4 highEPSS 0.5%

High (8.4). EPSS 0.5% chance of exploitation in the next 30 days.

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory.

Severity

CVSS 4.0

8.4 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H

CVSS 3.1

8.7 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWE: CWE-73
Published: 2026-09-09
Modified: 2026-09-14
Record from: the NVD, synced 2026-10-19

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-94vh-rpgr-rpwc
https://www.vulncheck.com/advisories/siyuan-before-3.8.2-path-traversal-via-removeriffdeck
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-94vh-rpgr-rpwc

Check your stack JSON