CVE-2026-86538

knowns versions prior to 0.30.0 contain a path traversal flaw (CWE-22) in the POST /api/templates/preview API endpoint. An unauthenticated remote attacker can send directory traversal sequences in the templateFile parameter, bypassing the endpoint's path restrictions. Because the file contents are returned in the JSON response, the attacker can read arbitrary files on the server, such as credentials and configuration files. Any deployment running a knowns version before 0.30.0 with the API reachable by untrusted clients is affected. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.7% probability of exploitation within 30 days, so exploitation is not currently observed.

What to do: Upgrade knowns to version 0.30.0 or later, which resolves the path traversal in /api/templates/preview. Until upgraded, restrict network access to the API (e.g., via firewall or reverse-proxy allowlists) and review server logs for requests containing traversal sequences such as ../ in the templateFile parameter to detect attempted or successful file reads.