Is CVE-2026-86775 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86775 being exploited in the wild.

How severe is CVE-2026-86775?

High severity, with a CVSS score of 8.6, published 9 September 2026.

Is there a fix for CVE-2026-86775?

A patch was published on 2026-09-09: Version 0.30.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86775 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-86775?

Check whether you run Knowns-Dev Knowns at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86775: knowns path traversal in Document API

CVE-2026-86775 · Severity: high · CVSS 8.6 · Published 2026-09-09

knowns is a documentation management platform. A flaw in how it handles file paths allows an unauthenticated attacker to read, create, overwrite, or delete files anywhere on the server's filesystem (limited to .md extensions) and create arbitrary directories. In default deployments where the API is unauthenticated and open to the network, this can expose sensitive project data, corrupt system files, and serve as a stepping stone to full server compromise via remote code execution.

Technologies: Knowns-Dev Knowns. Vendors: Knowns-Dev.

Quick answers

Is CVE-2026-86775 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86775 being exploited in the wild.
How severe is CVE-2026-86775?: High severity, with a CVSS score of 8.6, published 9 September 2026.
Which products and versions are affected?: Knowns-Dev Knowns <=0.29.1.
Is there a fix for CVE-2026-86775?: A patch was published on 2026-09-09: Version 0.30.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86775 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-86775?: Check whether you run Knowns-Dev Knowns at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal (CWE-22) in the Document API's file handling logic. The HTTP handler in internal/server/routes/docs.go normalizes user-supplied document paths using cleanDocPath(), which strips leading/trailing slashes and the .md suffix, but fails to neutralize ../ traversal sequences. The storage layer in internal/storage/doc_store.go then constructs file paths using filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+".md") without validating that the resolved path remains within the intended documents directory. An unauthenticated network attacker can exploit this by sending traversal payloads (e.g., {"path": "../../../../tmp/knowns_pwn_marker"}) to POST /api/docs or encoded paths to GET /api/docs/.. endpoints, achieving arbitrary read, write, delete, and directory creation operations on the filesystem. This is fixed in version 0.30.0.

Affected products

knowns-dev knowns <=0.29.1

Timeline

2026-08-14: disclosed
2026-09-09: advisory: NVD published CVE-2026-86775
2026-09-09: patched: Version 0.30.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.