A path traversal vulnerability in SiYuan versions prior to 3.8.2 allows an authenticated administrator to delete arbitrary system files, posing a high risk to data integrity and system stability.

This vulnerability is caused by improper input validation of the deckID parameter within the /api/riff/removeRiffDeck endpoint, which is susceptible to path traversal sequences. The flaw requires an authenticated administrator to trigger, enabling the deletion of files outside the designated workspace directory.

The ability to delete arbitrary files on the host system presents a severe threat to operational continuity and data integrity. Given the CVSS score of 8.7, this vulnerability is categorized as high severity, as it allows a privileged user to cause significant disruption or potentially render the application unusable by removing critical configuration or data files.

Immediate Action: Upgrade the SiYuan application to version 3.8.2 or later to include the necessary input validation fixes.

Proactive Monitoring: Audit server access logs for unusual requests to the /api/riff/removeRiffDeck endpoint, specifically looking for path traversal patterns such as dot-dot-slash sequences.

Compensating Controls: Ensure that the application process runs with the least privilege necessary, restricting its ability to access or delete files outside of its intended data directory to minimize the potential impact of a successful exploit.

Public Exploit Available: No (exploit_available: false)

The risk associated with this vulnerability is significant due to the potential for permanent data loss or system corruption. Administrators should prioritize the update to version 3.8.2 immediately to remediate the underlying flaw and prevent potential misuse by compromised or malicious administrative accounts.