CVE-2026-86775 in knowns
Summary
by MITRE • 09/09/2026
knowns (npm package) versions <= 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath(), which strips leading/trailing slashes and the .md suffix but does not neutralize ../ traversal sequences, and internal/storage/doc_store.go then builds the target path with filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+".md") without verifying that the resolved path remains inside the documents directory. In the default deployment, where the Management API is unauthenticated and bound to all interfaces, a remote unauthenticated attacker can supply a traversal payload (for example {"path": "../../../../tmp/knowns_pwn_marker"} to POST /api/docs, or an encoded path to GET /api/docs/...) to read, create, overwrite, or delete arbitrary files with a .md extension anywhere on the host filesystem and to create arbitrary directories via os.MkdirAll. This can expose sensitive data stored in other projects' documentation, corrupt or destroy files, and provide an arbitrary-write primitive that may be chained toward code execution. The issue is fixed in version 0.30.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified within the knowns npm package prior to version 0.30.0 represents a critical path traversal flaw located in the Document API implementation. This security defect stems from insufficient input validation and improper handling of user-supplied file paths during document processing operations. The core technical failure occurs because the HTTP handler responsible for managing document routes employs a normalization function that strips leading and trailing slashes as well as markdown suffixes but fails to sanitize directory traversal sequences such as double-dot notation. Consequently, when the storage layer constructs the final target path by joining the base documents directory with the user-provided path component, it does not verify whether the resulting absolute path remains confined within the intended document root directory. This lack of boundary enforcement allows an attacker to manipulate file system navigation logic to access locations outside the designated scope.
From a technical perspective, this flaw aligns directly with CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory. The vulnerability is further characterized by CWE-73 in cases where directory creation via os.MkdirAll is exploited, and potentially CWE-94 if the arbitrary write capability leads to code injection scenarios. In terms of offensive security frameworks, this behavior maps to ATT&CK technique T1083, which covers File and Directory Discovery, as well as T1222 for file permission modification or deletion when combined with overwrite capabilities. The absence of strict path canonicalization checks means that the application trusts user input implicitly after basic string manipulation, creating a significant gap in access control logic.
The operational impact of this vulnerability is severe due to the default deployment configuration where the Management API is unauthenticated and bound to all network interfaces. This exposure allows remote, unauthenticated attackers to exploit the path traversal flaw through standard HTTP methods such as POST requests to /api/docs or GET requests with encoded paths. By supplying carefully crafted payloads containing relative directory traversals, an attacker can read sensitive documentation from other projects stored on the host filesystem, overwrite existing markdown files to deface content, delete critical documents, or create new directories in arbitrary locations. The ability to write arbitrary data into .md files provides a primitive that could potentially be chained with other vulnerabilities to achieve remote code execution if those files are processed by downstream systems or parsers vulnerable to injection attacks.
To mitigate this risk, organizations must immediately upgrade the knowns package to version 0.30.0 or later, where the path traversal issue has been resolved through improved input sanitization and strict directory confinement checks. In environments where upgrading is not immediately feasible, temporary mitigations should include restricting access to the Management API via network segmentation or firewall rules to prevent unauthenticated external access. Additionally, implementing a Web Application Firewall with specific rules to detect and block HTTP requests containing path traversal sequences can provide an additional layer of defense. It is also recommended to run application services under restricted user privileges with minimal file system permissions to limit the potential damage even if exploitation occurs. Regular security audits focusing on input validation patterns in API handlers are essential to prevent similar vulnerabilities from being introduced in future updates.