A path traversal vulnerability in SiYuan allows an authenticated administrator to trigger arbitrary file deletion, potentially leading to system instability or service disruption.

The software contains a path traversal flaw (CWE-22) in the file management functionality. An attacker with high-level administrative privileges can manipulate path parameters to delete files outside of the intended directory.

While the attack requires administrative authentication, the ability to delete arbitrary files on the server poses a significant risk to system integrity and service availability. A CVSS score of 8.7 highlights that the impact on system files and configurations is severe, potentially resulting in permanent data loss or total application failure.

Immediate Action: Upgrade the SiYuan application to version 3.7.4 or later to address the insecure path handling logic.

Proactive Monitoring: Review administrative audit logs for suspicious file deletion activity or unusual access patterns involving system directories.

Compensating Controls: Implement file system permissions that restrict the application service account to only the directories absolutely necessary for its operation.

Public Exploit Available: No (no confirmed public exploit exists in available data).

Administrators should apply the provided patch immediately to prevent the potential for unauthorized file deletion. Restricting administrative access to trusted personnel remains a key defense-in-depth strategy for this application.