A critical path traversal vulnerability in SiYuan versions 3.6.3 and prior allows authenticated attackers to delete sensitive configuration and metadata files, potentially leading to a denial of service.

The application fails to validate the id parameter in the /api/av/removeUnusedAttributeView endpoint, permitting path traversal sequences. This allows an authenticated attacker to escape the intended directory and delete arbitrary JSON files on the server.

The ability to delete arbitrary JSON files poses a significant risk to system integrity and availability. An attacker could remove global configuration files or essential workspace metadata, resulting in service disruption or loss of user data. Although the CVSS score of 8.5 reflects high severity, the requirement for authentication limits the attack surface to existing users.

Immediate Action: Upgrade SiYuan to version 3.6.4 or later immediately to incorporate the necessary path validation fixes.

Proactive Monitoring: Review access logs for requests to the /api/av/removeUnusedAttributeView endpoint containing suspicious path traversal patterns such as "../".

Compensating Controls: Implement strict file system permissions for the service account running the SiYuan process to limit the impact of unauthorized file deletion.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates prompt action despite the authentication requirement. Organizations utilizing SiYuan should prioritize the update to version 3.6.4 to prevent potential service disruption through malicious file deletion. All administrators should ensure that the application is running with the principle of least privilege to minimize the potential damage from similar future vulnerabilities.