SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal sequences such as ../ into the id value to escape the intended directory and delete arbitrary .json files on the server, including global configuration files and workspace metadata. This issue has been fixed in version 3.6.4.
Affected: Go: github.com/siyuan-note/siyuan/kernel
## Summary
The endpoint `/api/av/removeUnusedAttributeView` is vulnerable to a **path traversal (CWE-22)** that allows an attacker to delete arbitrary `.json` files on the server.
The issue arises because user-controlled input (`id`) is directly used in filesystem path construction without validation or restriction.
> Access to this endpoint (e.g., via a Reader-role or publish context) is considered a precondition and not part of the vulnerability. The root cause is unsafe path handling.
---
## Steps To Reproduce
1. Ensure the target instance has the publish service enabled (or any valid access to the endpoint). 2. Send the following request:
```http POST /api/av/removeUnusedAttributeView HTTP/1.1 Host: <target> Content-Type: application/json
{ "id": "../../../conf/conf" } ```
3. Observe that the request is accepted. 4. The server resolves the path outside the intended directory and deletes the target file.
---
## Impact
An attacker can delete arbitrary `.json` files within the workspace directory.
This may lead to:
* Deletion of global configuration files (e.g., `conf/conf.json`) * Loss of user data and application state * Corruption of workspace metadata * Persistent application instability or forced recovery
This represents a **server-side arbitrary file deletion primitive**, which can have severe impact depending on the targeted files.
---
## Technical Details
The vulnerable code constructs file paths as follows:
```go filepath.Join(util.DataDir, "st…