CVE-2026-86542: Knowns Path Traversal Vulnerability

CVE-2026-86542 Overview

CVE-2026-86542 is a path traversal vulnerability [CWE-22] in the knowns project prior to version 0.30.0. The flaw exists in the import routes handler, which fails to validate the name parameter supplied to import endpoints. Unauthenticated attackers can inject directory traversal sequences to escape the imports directory and write files anywhere the server process has write access. Successful exploitation permits overwriting arbitrary files on the host, enabling configuration tampering, application code replacement, and follow-on remote code execution.

Critical Impact
Unauthenticated remote attackers can overwrite arbitrary files writable by the knowns server process, leading to integrity loss and potential code execution.

Affected Products

knowns versions prior to 0.30.0
Vulnerable source path: internal/server/routes/imports.go
Fixed release: knowns v0.30.0

Discovery Timeline

2026-09-07 - CVE-2026-86542 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86542

Vulnerability Analysis

The defect resides in the import routes defined in internal/server/routes/imports.go. The handler accepts a user-supplied name value and joins it with the configured imports directory to build a destination file path. Because the handler does not canonicalize the resulting path or reject traversal sequences, attackers can submit values containing ../ segments to redirect writes outside the intended directory.

The endpoint is exposed over the network and requires no authentication or user interaction. Any file the server process can write is a valid target, including binaries loaded at startup, configuration files, and language-server override paths. See the GitHub Security Advisory GHSA-wh3c-v55g-qfg8 and the VulnCheck Advisory Path Traversal for full advisory context.

Root Cause

The root cause is missing input validation on the import name parameter. The handler treats the parameter as a trusted filename fragment and passes it directly into path composition. The fix, applied in commit d3989829, introduces strict validation helpers that reject values containing untrimmed whitespace or values that do not match a known allow-listed candidate.

Attack Vector

Exploitation requires a single HTTP request to the vulnerable import route with a traversal payload in the name parameter. The attacker chains ../ segments to walk outside the imports directory and specifies a target path to overwrite. Overwriting binary override paths consumed by the language-server subsystem was identified as a companion RCE vector in the same patch.

// Security patch: internal/lsp/binary_override.go
// Adds strict allow-listed selection of override candidates.
package lsp

import (
	"fmt"
	"strings"
)

func selectBinaryCandidateOverride(override string, candidates []BinaryCandidate) (BinaryCandidate, error) {
	if strings.TrimSpace(override) != override || override == "" {
		return BinaryCandidate{}, invalidBinaryOverride(override)
	}
	for _, candidate := range candidates {
		if candidate.Name == override {
			return candidate, nil
		}
	}
	return BinaryCandidate{}, invalidBinaryOverride(override)
}

func selectBinaryOverride(override string, candidates []Binary) (Binary, error) {
	if strings.TrimSpace(override) != override || override == "" {
		return Binary{}, invalidBinaryOverride(override)
	}
	for _, candidate := range candidates {
		if candidate.Name == override {
			return candidate, nil
		}
	}
	return Binary{}, invalidBinaryOverride(override)
}

Source: GitHub Commit d3989829

The patch replaces free-form override strings with a strict lookup against a known candidate list, rejecting any value that contains leading or trailing whitespace or that does not match a registered name. The same commit applies analogous rejection logic in the LSP detector:

 func (d *Detector) resolve(ctx context.Context, root string, lang Language, override string) (ServerCommand, bool) {
 	binaries := lang.Binaries
 	if override != "" {
-		binary := Binary{Name: override}
-		if len(binaries) > 0 {
-			binary.CheckArgs = append([]string(nil), binaries[0].CheckArgs...)
+		binary, err := selectBinaryOverride(override, binaries)
+		if err != nil {
+			return ServerCommand{}, false
 		}
 		binaries = []Binary{binary}
 	}

Source: GitHub Commit d3989829

Detection Methods for CVE-2026-86542

Indicators of Compromise

HTTP requests to import routes containing ../, ..\\, URL-encoded %2e%2e%2f, or absolute path prefixes in the name parameter.
Unexpected file writes outside the configured imports directory owned by the knowns server user.
Modified timestamps on knowns binaries, language-server override files, or configuration files without a corresponding deployment event.

Detection Strategies

Inspect application and reverse-proxy access logs for POST requests to import endpoints where the name parameter contains traversal metacharacters.
Deploy file integrity monitoring on the knowns install directory, imports directory parent, and any LSP binary override paths.
Correlate write events from the knowns process against expected import-file naming conventions, alerting on divergence.

Monitoring Recommendations

Enable verbose HTTP request logging on the knowns service and forward logs to a central analytics platform for retention and search.
Alert on any child process spawn from knowns that is not part of a documented LSP workflow.
Track outbound network activity from hosts running knowns to detect post-exploitation staging following successful file overwrite.

How to Mitigate CVE-2026-86542

Immediate Actions Required

Upgrade knowns to version 0.30.0 or later, which contains the fix from commit d3989829.
Restrict network exposure of the knowns service to trusted networks and place it behind an authenticating reverse proxy.
Run the knowns process as an unprivileged account with write access limited strictly to its data directories.

Patch Information

The fix is available in the GitHub Release v0.30.0. The relevant code change is documented in GitHub Commit d3989829. Review the vulnerable pre-patch code at GitHub Code Snippet Import Routes and GitHub Code Snippet Import Routes Part 2 to identify affected deployments.

Workarounds

Block or filter HTTP requests to import routes containing .., encoded traversal sequences, or absolute path characters at the reverse proxy or WAF layer.
Apply mandatory access controls (SELinux, AppArmor) to confine the knowns process to its intended directories.
Disable the import functionality entirely if it is not required by the deployment.

bash

# Example nginx rule to reject traversal payloads on import routes
location /imports/ {
    if ($arg_name ~* "(\.\.|%2e%2e|/|\\\\)") {
        return 400;
    }
    proxy_pass http://knowns_backend;
}