Executive brief
knowns is a data management application that processes file imports. The import functionality fails to properly validate user-supplied file names, allowing unauthenticated attackers to write files outside the intended imports directory. An attacker can use path traversal sequences (like "../") to overwrite arbitrary files on the server, potentially compromising data integrity and system availability.
Technical details
The vulnerability is a path traversal flaw in the import routes handler (internal/server/routes/imports.go) that fails to validate the import name parameter. Attackers can craft malicious requests with traversal sequences such as "../" in the name parameter to escape the imports directory boundary. The server processes these requests without authentication and writes files to arbitrary locations writable by the server process. An attacker can achieve arbitrary file write, enabling system compromise, configuration manipulation, or denial of service. The vulnerability is fixed in version 0.30.0 and later.
Affected products
- knowns knowns before 0.30.0
Timeline
- 2026-09-07: disclosed: CVE-2026-86542 published
- 2026-09-07: patched: Fixed in version 0.30.0