Critical severity · published Sep 7, 2026
CVE-2026-86542
knowns before 0.30.0 Path Traversal via Import Name
9.1
CVSS
0.7%
EPSS
No
On KEV
Description
knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the server process.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KN
knowns · knowns-dev
before 0.30.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86542
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86542
github.com
https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/routes/imports.go#L376-L420
github.com
https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/routes/imports.go#L519-L551
github.com
https://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396
github.com
https://github.com/knowns-dev/knowns/releases/tag/v0.30.0
github.com
https://github.com/knowns-dev/knowns/security/advisories/GHSA-wh3c-v55g-qfg8
www.vulncheck.com
https://www.vulncheck.com/advisories/knowns-before-0.30.0-path-traversal-via-import-name
More from knowns
9.8
CVE-2026-88899
knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header
9.8
CVE-2026-86543
knowns before 0.30.0 Unauthenticated Management API Exposure
8.8
CVE-2026-88937
knowns through 0.33.0 Path Traversal via Template Engine
8.8
CVE-2026-86439
knowns before 0.30.0 Path Traversal via MCP doc and memory tools
8.6
CVE-2026-86775
knowns before 0.30.0 Path Traversal via Document API