---
id: CVE-2026-60084
title: >-
  SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability
  in the /api/search/removeTemplate endpoint that accepts an unvalidated path
  parameter passed directly to os.RemoveAll
summary: >-
  SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability
  in the /api/search/removeTemplate endpoint that accepts an unvalidated path
  parameter passed directly to os.RemoveAll. Authenticated admin attackers can
  suppl…
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H'
cwe:
  - CWE-22
published: '2026-08-22'
updated: '2026-08-22'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-60084'
references:
  - url: >-
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w938-w7m4-qrj8
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/siyuan-before-arbitrary-file-deletion-via-removetemplate
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-08-23T04:42:14.547Z'
epss: 0.00346
epssPercentile: 0.28217
---

## Overview

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file or directory the kernel process has permission to remove, anywhere on the host filesystem.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.