CVE-2026-60084Disclosure

LOWCVSS 8.4 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file or directory the kernel process has permission to remove, anywhere on the host filesystem.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-60084

Full discourse1 post

Vulmon Vulnerability Feed@VulmonFeeds46d
Disclosure
CVE-2026-60084 Arbitrary File Deletion in SiYuan v3.7.4 via Unvalidated Path Parameter https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-60084
Post summary
CVE-2026-60084 discloses an arbitrary file deletion flaw in SiYuan v3.7.4 caused by an unvalidated path parameter; no PoC, exploitation code, patch, or active exploitation information is provided.
00000110
4.1K followersView on X

Explore more

Back to dashboard