CVE-2026-86538: knowns before 0.30.0 Path Traversal via templateFile parameter
knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read sensitive files like credentials and configuration through the JSON response.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
POST /api/templates/preview (templateFile parameter)to a version that resolves this vulnerability.Fixed in 0.30.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated attacker able to reach the POST /api/templates/preview endpoint can exploit it. No credentials or user interaction are required.
What access can an attacker gain?
An attacker can use directory traversal sequences in the templateFile parameter to read arbitrary files through the JSON response. This may expose sensitive local files such as credentials and configuration.
Which versions are affected?
knowns versions before 0.30.0 are affected. Upgrading to version 0.30.0 or later addresses the issue.