CVE-2026-86538 | BDVDB-2026-368917 Detail
knowns-devknowns
Description#
knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read sensitive files like credentials and configuration through the JSON response.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References#
- https://github.com/knowns-dev/knowns/security/advisories/GHSA-fpxv-c555-rhm3
- https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/routes/templates.go#L299-L310
- https://github.com/knowns-dev/knowns/commit/09c5a96fd5817b941dc86669278c1a17db10ed4e
- https://github.com/knowns-dev/knowns/releases/tag/v0.30.0
- https://www.vulncheck.com/advisories/knowns-before-0.30.0-path-traversal-via-templatefile-parameter
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.