A critical path traversal flaw in the knowns import routes allows unauthenticated remote attackers to write files outside the imports directory and overwrite arbitrary files writable by the server process.
What Is It
knowns before 0.30.0 fails to validate import names in its import routes. An attacker can supply directory traversal sequences in the name parameter to escape the intended imports directory, then write or overwrite any file the server process has permission to modify.
The issue is tracked as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and carries a CVSS 3.1 base score of 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. A secondary CVSS 4.0 score of 8.8 (HIGH) is also assigned.
Why It Matters
The scoring tells the story: network attack vector, low complexity, no privileges and no user interaction required. There is no authentication barrier in front of this; anyone who can reach the import routes can attempt it.
Impact is rated HIGH for both integrity and availability, with no confidentiality impact. This is a write primitive, not a read primitive. Overwriting arbitrary server-writable files puts configuration, application data, and service availability directly at risk.
There is no CISA KEV entry for this CVE, and exploit maturity is listed as NOT_DEFINED in the CVSS 4.0 vector; so there is no confirmation of active exploitation in the supplied data.
What's Vulnerable
- Vendor: knowns-dev
- Product: knowns (
pkg:golang/github.com/knowns-dev/knowns) - Affected: all versions before 0.30.0
- Not affected: 0.30.0 and later
The vulnerable code paths were disclosed in internal/server/routes/imports.go as of tag v0.29.1.
Patch Status
Fixed in knowns 0.30.0. The fix landed in commit d3989829fb5095666d23d005b2f78a082832a396. Operators running any earlier version should upgrade to 0.30.0 or later. The record was published 2026-09-07 by VulnCheck and currently sits in NVD status "Received."
Sources
- NVD, CVE-2026-86542 (source: [email protected])
- VulnCheck Advisory: https://www.vulncheck.com/advisories/knowns-before-0.30.0-path-traversal-via-import-name
- GitHub Security Advisory GHSA-wh3c-v55g-qfg8: https://github.com/knowns-dev/knowns/security/advisories/GHSA-wh3c-v55g-qfg8
- Fix commit: https://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396
- Release v0.30.0: https://github.com/knowns-dev/knowns/releases/tag/v0.30.0
- Vulnerable code (v0.29.1): https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/routes/imports.go#L376-L420
- Vulnerable code (v0.29.1): https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/routes/imports.go#L519-L551