Executive brief
knowns is a documentation management platform. A flaw in how it handles file paths allows an unauthenticated attacker to read, create, overwrite, or delete files anywhere on the server's filesystem (limited to .md extensions) and create arbitrary directories. In default deployments where the API is unauthenticated and open to the network, this can expose sensitive project data, corrupt system files, and serve as a stepping stone to full server compromise via remote code execution.
Technical details
The vulnerability is a path traversal (CWE-22) in the Document API's file handling logic. The HTTP handler in internal/server/routes/docs.go normalizes user-supplied document paths using cleanDocPath(), which strips leading/trailing slashes and the .md suffix, but fails to neutralize ../ traversal sequences. The storage layer in internal/storage/doc_store.go then constructs file paths using filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+".md") without validating that the resolved path remains within the intended documents directory. An unauthenticated network attacker can exploit this by sending traversal payloads (e.g., {"path": "../../../../tmp/knowns_pwn_marker"}) to POST /api/docs or encoded paths to GET /api/docs/.. endpoints, achieving arbitrary read, write, delete, and directory creation operations on the filesystem. This is fixed in version 0.30.0.
Affected products
- knowns-dev knowns <=0.29.1
Timeline
- 2026-08-14: disclosed
- 2026-09-09: advisory: NVD published CVE-2026-86775
- 2026-09-09: patched: Version 0.30.0 released with fix