CVE-2026-87815 is a path traversal vulnerability in SiYuan note-taking software before version 3.8.2. The vulnerability exists in the /api/riff/removeRiffDeck endpoint, which does not properly validate the deckID parameter. An authenticated administrator can exploit this by providing path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory, potentially leading to unauthorized file deletion.

An authenticated administrator can delete arbitrary files with .deck and .cards extensions outside the workspace directory, which may result in data loss or disruption of application functionality. The vulnerability requires administrator privileges and no user interaction, with a high attack vector and complexity as per the CVSS 4.0 score of 8.4.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access and monitor usage of the /api/riff/removeRiffDeck endpoint to mitigate potential exploitation.