CVE-2026-86538: knowns Path Traversal Vulnerability

CVE-2026-86538 Overview

CVE-2026-86538 is a path traversal vulnerability [CWE-22] affecting the Knowns application in versions before 0.30.0. The flaw resides in the POST /api/templates/preview endpoint. Unauthenticated attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions. The server returns the requested file contents in the JSON response, enabling arbitrary file read. Attackers can extract credentials, configuration files, private keys, and other sensitive data from the host filesystem. The vulnerability was addressed in Knowns v0.30.0 with the introduction of a dedicated safepath package that constrains untrusted paths inside an explicit root.

Critical Impact
Unauthenticated remote attackers can read arbitrary files from the Knowns server, exposing credentials and configuration data through a single crafted HTTP request.

Affected Products

Knowns versions prior to 0.30.0
Knowns v0.29.1 (confirmed vulnerable via referenced source code)
The POST /api/templates/preview route handler in internal/server/routes/templates.go

Discovery Timeline

2026-09-07 - CVE-2026-86538 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86538

Vulnerability Analysis

The vulnerability affects the template preview functionality of the Knowns application. The POST /api/templates/preview endpoint accepts a templateFile parameter that identifies a template to render. The handler concatenates this attacker-controlled value onto a base directory without normalizing traversal sequences such as ../. It then reads the resulting path and returns the file contents in the JSON response body.

Because the endpoint requires no authentication, any network-reachable attacker can invoke it. The response channel returns raw file contents, converting a path resolution flaw into a direct information disclosure primitive. Sensitive targets include /etc/passwd, /etc/shadow on misconfigured deployments, application configuration files, SSH keys, and cloud credential files under user home directories.

Root Cause

The root cause is missing containment of untrusted filesystem paths inside an explicit root directory. The pre-patch handler in internal/server/routes/templates.go (lines 299-310 of v0.29.1) trusts the client-supplied templateFile value. It lacks checks for absolute paths, parent directory references, symlink escapes, and Windows volume-qualified paths.

Attack Vector

An unauthenticated attacker sends a single HTTP POST request to /api/templates/preview with a templateFile value containing directory traversal sequences. The server resolves the path outside the templates directory and returns the target file contents in the JSON response.

// Post-patch containment logic introduced in v0.30.0
// Source: https://github.com/knowns-dev/knowns/commit/09c5a96fd5817b941dc86669278c1a17db10ed4e

// Package safepath resolves untrusted filesystem paths inside an explicit root.
package safepath

import (
	"fmt"
	"os"
	"path/filepath"
	"regexp"
	"runtime"
	"strings"
)

var windowsVolumePath = regexp.MustCompile(`^[A-Za-z]:`)

// Resolve resolves an untrusted relative path inside root. Absolute paths,
// parent traversal, Windows volume paths, and symlink escapes are rejected.
func Resolve(root, untrusted string) (string, error) {
	return resolve(root, untrusted, false)
}

// ResolveProject resolves a project path inside root. Native absolute paths
// are accepted only when they still resolve inside root.
func ResolveProject(root, untrusted string) (string, error) {
	return resolve(root, untrusted, true)
}

Source: GitHub Commit 09c5a96

Detection Methods for CVE-2026-86538

Indicators of Compromise

HTTP POST requests to /api/templates/preview containing ../ sequences or URL-encoded variants such as %2e%2e%2f in the templateFile parameter.
Requests to the templates preview endpoint referencing absolute paths like /etc/passwd, /root/.ssh/id_rsa, or Windows paths beginning with a drive letter.
Unexpected 200 OK responses from /api/templates/preview containing file content signatures such as -----BEGIN (private keys) or root:x: (Unix password file).

Detection Strategies

Deploy web application firewall rules that inspect POST bodies to /api/templates/preview for traversal patterns and reject requests matching \.\.[\\/] or encoded equivalents.
Enable verbose access logging on the Knowns reverse proxy and alert on any request to /api/templates/preview originating from unauthenticated sessions.
Correlate high response body sizes from the templates preview endpoint against a known-good baseline of legitimate template previews.

Monitoring Recommendations

Ingest Knowns application and proxy logs into a centralized analytics platform and build queries for traversal token frequency against the templateFile parameter.
Track outbound reads of sensitive files by the Knowns service account using host-based file integrity monitoring and audit rules on /etc/ and credential directories.
Alert on any process spawned by the Knowns binary that accesses SSH keys, cloud credentials, or environment files outside the template directory.

How to Mitigate CVE-2026-86538

Immediate Actions Required

Upgrade Knowns to v0.30.0 or later, which introduces the safepath package to reject absolute paths, parent traversal, Windows volume paths, and symlink escapes.
Restrict network access to the Knowns /api/templates/preview endpoint using a reverse proxy or firewall until patching completes.
Rotate any credentials, API tokens, or private keys stored on hosts running vulnerable Knowns versions, since exposure cannot be ruled out.

Patch Information

The fix is released in Knowns v0.30.0 and tracked as GHSA-fpxv-c555-rhm3. The remediation commit 09c5a96fd5817b941dc86669278c1a17db10ed4e adds a new internal/safepath package that resolves untrusted paths inside a declared root and rejects absolute paths, parent traversal, and symlink escapes. Additional validation in internal/models/memory.go restricts memory identifiers to the pattern ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$. See the VulnCheck advisory for additional detail.

Workarounds

Block or return 403 Forbidden for all requests to /api/templates/preview at the reverse proxy layer until the upgrade is complete.
Run the Knowns process under a dedicated unprivileged user with filesystem access limited to the templates directory using chroot, containerization, or systemd sandboxing directives.
Configure a web application firewall to reject requests where the templateFile parameter contains .., backslashes, absolute paths, or URL-encoded traversal sequences.

bash

# Example NGINX snippet to block the vulnerable endpoint until patched
location = /api/templates/preview {
    return 403;
}

# Example systemd hardening for the Knowns service unit
# /etc/systemd/system/knowns.service.d/override.conf
[Service]
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/knowns
PrivateTmp=true
NoNewPrivileges=true