THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-60084 (HIGH 8.7) — SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively

[NVD] CVE-2026-60084 (HIGH 8.7) — SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively

mednvdPublished 2026-08-22

CVE-2026-60084 CVSS: 8.7 HIGH Published: 2026-08-22T13:16:39.407

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file or directory the kernel process has pe

MITRE ATT&CK techniques

File DeletionT1070.004

Indicators of compromise

CVE-2026-60084cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-60084