CVE-2026-88899

knowns versions before 0.31.0 contain a path traversal flaw (CWE-73, External Control of File Name or Path) in the /api/opencode proxy endpoint, which fails to validate the x-opencode-directory request header. An unauthenticated remote attacker can send a crafted header containing arbitrary directory paths, causing the endpoint to perform file operations outside the intended project root on the host system. Depending on the permissions of the service process, this can allow reading, writing, or otherwise manipulating files anywhere on the host, which the critical 9.3 CVSS 4.0 score reflects with high ratings for confidentiality, integrity, and availability impact. Anyone running an affected version of knowns with the opencode proxy endpoint reachable over the network is affected. There are currently no reports of in-the-wild exploitation, no known public proof-of-concept, and the issue is not in CISA's Known Exploited Vulnerabilities catalog.

What to do: Upgrade to knowns 0.31.0 or later, where the x-opencode-directory header is properly validated. If upgrading is not immediately possible, restrict network access to the /api/opencode endpoint (e.g., via reverse proxy rules), strip or validate the x-opencode-directory header, and run the service with least-privilege filesystem permissions. Administrators should also review host file integrity on exposed instances for signs of unexpected modifications.