CVE-2026-86775: knowns npm Package Path Traversal Flaw

CVE-2026-86775 Overview

CVE-2026-86775 is a path traversal vulnerability [CWE-22] in the knowns npm package, affecting all versions up to and including 0.29.1. The flaw resides in the Document API handler in internal/server/routes/docs.go, which fails to neutralize ../ sequences in user-supplied document paths. In the default deployment, the Management API is unauthenticated and bound to all interfaces, allowing remote unauthenticated attackers to read, create, overwrite, or delete arbitrary files with a .md extension on the host filesystem. The vulnerability is fixed in version 0.30.0.

Critical Impact
Remote unauthenticated attackers can perform arbitrary file read, write, and delete operations across the host filesystem, and create arbitrary directories via os.MkdirAll, providing a primitive that can be chained toward code execution.

Affected Products

knowns npm package versions <= 0.29.1
knowns Document API (internal/server/routes/docs.go)
knowns document storage backend (internal/storage/doc_store.go)

Discovery Timeline

2026-09-09 - CVE-2026-86775 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86775

Vulnerability Analysis

The vulnerability originates in the Document API HTTP handler. The cleanDocPath() function normalizes user-supplied document paths by stripping leading and trailing slashes and the .md suffix. It does not, however, neutralize ../ traversal sequences.

Downstream, internal/storage/doc_store.go constructs the target file path with filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+".md"). The code does not verify that the resolved path remains within the intended documents directory. Any file operation performed by the handler therefore escapes the storage root.

Because the Management API binds to all interfaces without authentication in the default configuration, the attack surface is exposed to any network-reachable client. Successful exploitation permits reading sensitive documentation from other projects, corrupting or destroying files with a .md extension, and creating arbitrary directories on the host.

Root Cause

The root cause is missing path canonicalization and boundary enforcement. cleanDocPath() treats normalization as a cosmetic string operation rather than a security control. The storage layer trusts the caller's input and does not validate that the final joined path is a descendant of ds.docsDir().

Attack Vector

An unauthenticated attacker sends an HTTP request to the Document API with a traversal payload in the path parameter. For example, a POST request to /api/docs with a JSON body such as {"path": "../../../../tmp/knowns_pwn_marker"} writes a file outside the documents directory. Encoded traversal sequences delivered through GET /api/docs/... similarly retrieve or manipulate files anywhere the service process has access. The arbitrary-write primitive can target files consumed by other services on the host, enabling downstream code execution.

No verified proof-of-concept code has been published beyond the illustrative payload described in the advisory. See the GitHub Security Advisory and the VulnCheck Advisory for Known's for full technical detail.

Detection Methods for CVE-2026-86775

Indicators of Compromise

Unexpected .md files appearing in system directories such as /tmp, /etc, /var, or user home directories on hosts running knowns.
New directories created outside the configured docsDir() that match the ownership of the knowns service process.
HTTP request logs containing ../ sequences, URL-encoded variants (%2e%2e%2f), or absolute paths in /api/docs endpoint parameters.

Detection Strategies

Inspect access logs for the knowns Management API for requests to /api/docs and /api/docs/* containing traversal patterns in the path JSON field or URL segment.
Monitor filesystem writes performed by the knowns process outside its configured documents directory using auditd or equivalent file integrity tooling.
Alert on directory creation events by the knowns service user outside expected paths.

Monitoring Recommendations

Enable verbose HTTP request logging on the Management API and forward logs to a central analytics platform for query.
Deploy file integrity monitoring on sensitive directories reachable by the knowns process user.
Baseline expected outbound and inbound network traffic to the Management API port and flag anomalous unauthenticated access.

How to Mitigate CVE-2026-86775

Immediate Actions Required

Upgrade knowns to version 0.30.0 or later, which contains the fix for the path traversal in the Document API.
Restrict network exposure of the Management API by binding it to 127.0.0.1 or a trusted management interface rather than all interfaces.
Place the Management API behind an authenticated reverse proxy or network access control list until patching is complete.

Patch Information

The issue is fixed in knowns version 0.30.0. The fix enforces that resolved paths remain inside the documents directory after filepath.Join. Refer to the GitHub Security Advisory GHSA-3h35-4jq7-hv45 for release details.

Workarounds

Bind the Management API to localhost and require an authenticating proxy for remote administrative access.
Run the knowns service as an unprivileged user with filesystem access limited to the documents directory to reduce the blast radius of arbitrary writes.
Apply host-based firewall rules that restrict access to the Management API port to a management subnet.

bash

# Example: restrict knowns Management API to localhost and firewall the port
# Bind service to loopback (adjust to your deployment's configuration mechanism)
export KNOWNS_LISTEN_ADDR="127.0.0.1:8080"

# Block external access at the host firewall
sudo iptables -A INPUT -p tcp --dport 8080 ! -s 127.0.0.1 -j DROP