CyberRota Analysis
AI-GeneratedVersions of SiYuan prior to 3.8.2 are susceptible to a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint, allowing authenticated administrators to manipulate the deckID parameter. This flaw enables the deletion of arbitrary .deck and .cards files outside the designated workspace directory, potentially leading to data loss or service disruption. Organizations using affected versions should prioritize patching to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory.