CVE-2026-86775: knowns before 0.30.0 Path Traversal via Document API
knowns (npm package) versions <= 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath(), which strips leading/trailing slashes and the .md suffix but does not neutralize ../ traversal sequences, and internal/storage/docstore.go then builds the target path with filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+".md") without verifying that the resolved path remains inside the documents directory. In the default deployment, where the Management API is unauthenticated and bound to all interfaces, a remote unauthenticated attacker can supply a traversal payload (for example {"path": "../../../../tmp/knownspwnmarker"} to POST /api/docs, or an encoded path to GET /api/docs/...) to read, create, overwrite, or delete arbitrary files with a .md extension anywhere on the host filesystem and to create arbitrary directories via os.MkdirAll. This can expose sensitive data stored in other projects' documentation, corrupt or destroy files, and provide an arbitrary-write primitive that may be chained toward code execution. The issue is fixed in version 0.30.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
knowns (npm package)to a version that resolves this vulnerability.Fixed in 0.30.0
Event History
Frequently Asked Questions
Which deployments are most exposed?
Default deployments are most exposed because the Management API is unauthenticated and bound to all interfaces. In that configuration, a remote attacker can reach the vulnerable Document API without credentials.
What access or interaction does an attacker need?
An attacker only needs network access to the Management API. Exploitation requires no privileges or user interaction and can be performed through crafted document paths supplied to the API.
What can an attacker do through the vulnerable API?
The attacker can read, create, overwrite, or delete files ending in .md outside the documents directory, and can create directories through the storage path handling. This may expose documentation data, corrupt files, or provide an arbitrary-write primitive that could be chained toward code execution.
What should be done if an immediate upgrade is not possible?
Restrict access to the Management API so it is not reachable by untrusted remote users, particularly because the default binding exposes it on all interfaces without authentication. Upgrade to version 0.30.0 when possible.