SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute filesystem paths to recursively delete any file or directory the kernel process has permission to remove, anywhere on the host filesystem.

SiYuan versions prior to v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate API endpoint. The vulnerability arises from an unvalidated path parameter that is passed directly to Go's os.RemoveAll function. Authenticated admin attackers can exploit this by supplying absolute filesystem paths, enabling recursive deletion of any file or directory accessible by the kernel process. This effectively allows an attacker to delete critical system files or application data anywhere on the host filesystem. The vulnerability is classified as high severity due to the potential for irreversible data destruction. A fix has been issued in SiYuan v3.7.4. Security advisories have been published on GitHub and VulnCheck. The issue requires admin-level authentication, slightly limiting the attack surface but not eliminating the risk in environments with multiple admins or compromised credentials.