CVE-2026-86542

CVE-2026-86542 is a path traversal vulnerability (CWE-22) in the import feature of knowns, which does not validate the import names submitted to its import routes. Because these routes require no authentication, a remote attacker can supply directory-traversal sequences in the 'name' parameter to escape the imports directory. This lets the attacker create or overwrite arbitrary files writable by the server process, which the 8.8 (High) CVSS 4.0 score reflects as high impact to data integrity and availability. Any deployment running knowns before version 0.30.0 is affected. There is no evidence of exploitation so far: no public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates only a ~0.5% chance of exploitation within 30 days.

What to do: Upgrade to knowns 0.30.0 or later, which validates import names and closes the traversal. Until upgraded, restrict network access to the import routes (e.g., firewall rules or reverse-proxy controls) since exploitation requires no authentication or user interaction. If compromise is suspected, check files writable by the server process for unexpected modifications, as overwrites of critical files could also cause service disruption.