CVE-2026-86542: knowns before 0.30.0 Path Traversal via Import Name
Published Sep 7, 2026
·Updated
knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the server process.
Affected Software
1 affected component
unknowns<0.30.0
Event History
Sep 7, 2026
CVE Published
via MITRE·11:03 PM
Data Sourced
via MITRE·11:03 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
No authentication or user interaction is required. The issue is network-reachable and has low attack complexity.
2
Which deployments require remediation?
Versions before 0.30.0 are affected. An attacker can use traversal sequences in the import name parameter to write outside the imports directory, limited by files writable by the server process.