CVE-2026-87815

SiYuan, an open-source knowledge-management/note-taking server, contains a path traversal flaw (CWE-73) in the /api/riff/removeRiffDeck endpoint, where the deckID parameter is not validated. An authenticated administrator can send path traversal sequences in deckID, causing the endpoint to delete .deck and .cards files at arbitrary locations outside the workspace directory, potentially destroying flashcard data and other files on the host. Because the request must come from an administrator account, exploitation requires compromised or malicious admin credentials; the impact is loss of data integrity and availability (no confidentiality impact). All SiYuan deployments running versions before v3.8.2 are affected. As of this writing there is no known in-the-wild exploitation, no public proof-of-concept, and the issue is not in the CISA KEV catalog.

What to do: Upgrade SiYuan to v3.8.2 or later, which validates the deckID parameter in /api/riff/removeRiffDeck. Until then, restrict administrator access to the instance (strong authentication, limited exposure of the API over the network) and maintain backups of workspace and flashcard (.deck/.cards) data; administrators should verify that flashcard data has not been unexpectedly deleted and restore from backups if needed.