CVE-2026-86775

knowns (npm package) versions 0.29.1 and earlier contain a path traversal flaw (CWE-22) in the Document API: the docs.go HTTP handler's cleanDocPath() strips leading/trailing slashes and the .md suffix but does not neutralize ../ traversal sequences, and doc_store.go joins the user-supplied path onto the documents directory without verifying the resolved path stays inside it. In the default deployment, where the Management API is unauthenticated and bound to all interfaces, a remote unauthenticated attacker can send a traversal payload such as {'path': '../../../../tmp/knowns_pwn_marker'} to POST /api/docs, or an encoded traversal path to GET /api/docs/..., to escape the documents directory. The attacker gains the ability to read, create, overwrite, or delete any .md file anywhere on the host filesystem and to create arbitrary directories via os.MkdirAll, which can expose sensitive documentation from other projects, corrupt or destroy files, and — via the arbitrary-write primitive — may be chained toward code execution. Any deployment of knowns 0.29.1 or earlier with the Document API reachable is affected, particularly the default unauthenticated, all-interfaces configuration. There is no known exploitation in the wild, no public proof-of-concept, and no CISA KEV listing; the flaw is rated 8.8 (High) under CVSS 4.0 and is fixed in version 0.30.0.

What to do: Upgrade knowns to version 0.30.0, which fixes the path traversal. If upgrading is not immediately possible, restrict the Management API to trusted interfaces or localhost and place it behind authentication or a firewall, since the default configuration is unauthenticated and bound to all interfaces. Audit affected hosts for unexpected .md files or newly created directories outside the documents directory that could indicate traversal-based reads or writes.