CVE-2026-60084

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint. The endpoint accepts an unvalidated path parameter that is passed directly to os.RemoveAll, allowing an authenticated admin attacker to supply absolute filesystem paths and r...