Critical
knowns before 0.30.0 Path Traversal via Import Name
knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the server process.
Announced Source revision 1
Original source ↗CVE-2026-86542
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-86542
knowns
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "knowns-dev",
"product": "knowns",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "0.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.30.0",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/knowns",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-86542
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #1600 · Revision 1
- Added to Heist Feed
- Publisher date