---
id: CVE-2026-60084
title: >-
  SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability
  in the /api/search/removeTemplate endpoint that accepts an unvalidated path
  parameter passed directly to os.RemoveAll
summary: >-
  SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability
  in the /api/search/removeTemplate endpoint that accepts an unvalidated path
  parameter passed directly to os.RemoveAll. Authenticated admin attackers can
  suppl…
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H'
cwe:
  - CWE-22
published: '2026-08-22'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T16:10:00.220'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-60084'
references:
  - url: >-
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w938-w7m4-qrj8
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/siyuan-before-arbitrary-file-deletion-via-removetemplate
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w938-w7m4-qrj8
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00397
epssPercentile: 0.33726
ingestedAt: '2026-08-23T04:42:14.547Z'
---

## Overview

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file or directory the kernel process has permission to remove, anywhere on the host filesystem.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.