Is CVE-2026-86538 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86538 being exploited in the wild.

How severe is CVE-2026-86538?

High severity, with a CVSS score of 7.5, published 7 September 2026.

Is there a fix for CVE-2026-86538?

A patch was published on 2026-08-16: Security fix committed to contain filesystem paths in version 0.30.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86538 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86538?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86538: knowns path traversal in POST /api/templates/preview

CVE-2026-86538 · Severity: high · CVSS 7.5 · Published 2026-09-07

knowns is an application that processes and previews template files. A vulnerability in the template preview endpoint allows unauthenticated attackers to read arbitrary files from the server by supplying directory traversal sequences, potentially exposing sensitive configuration data, credentials, and other confidential information.

Quick answers

Is CVE-2026-86538 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86538 being exploited in the wild.
How severe is CVE-2026-86538?: High severity, with a CVSS score of 7.5, published 7 September 2026.
Which products and versions are affected?: knowns knowns before 0.30.0.
Is there a fix for CVE-2026-86538?: A patch was published on 2026-08-16: Security fix committed to contain filesystem paths in version 0.30.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86538 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86538?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in the POST /api/templates/preview endpoint of knowns before version 0.30.0. The templateFile parameter is not properly validated, allowing attackers to supply sequences like "../" to traverse the filesystem and read files outside the intended template directory. The vulnerability is unauthenticated and requires only network access to the endpoint. Attackers can read arbitrary files on the server and receive the contents in the JSON response. The issue is fixed in version 0.30.0 and later, with a commit dated 2026-08-16 that implements filesystem path restrictions.

Affected products

knowns knowns before 0.30.0

Timeline

2026-09-07: disclosed: CVE-2026-86538 published
2026-08-16: patched: Security fix committed to contain filesystem paths in version 0.30.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.