High severity8.7NVD Advisory· Published Sep 9, 2026· Updated Sep 14, 2026

CVE-2026-87815

Description

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Siyuan Note/Siyuanllm-fuzzy2 versions
<3.8.2+ 1 more
- (no CPE)range: <3.8.2
- (no CPE)range: <3.8.2

Patches

Vulnerability mechanics

References

github.com/siyuan-note/siyuan/security/advisories/GHSA-94vh-rpgr-rpwcnvd
www.vulncheck.com/advisories/siyuan-before-3.8.2-path-traversal-via-removeriffdecknvd

News mentions

Siyuan Note: Ten Vulnerabilities Including Code Execution and SQLi Disclosed Together
Vypr Intelligence · Sep 9, 2026

cvss	0.565
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000