CVE-2026-86775 knowns-dev CVE debrief

Who should care

Defenders of systems using knowns npm package version <= 0.29.1 should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify that the Management API is authenticated and not bound to all interfaces, and ensure that systems are updated to version 0.30.0 or later.

Why it matters

CVE-2026-86775 is a high-severity path traversal vulnerability in the knowns npm package that allows remote unauthenticated attackers to manipulate files and directories on the host filesystem. Defenders should prioritize remediation and verify that the Management API is authenticated and not bound to all interfaces.

• Arbitrary file read, create, overwrite, or delete with a .md extension
• Arbitrary directory creation via os.MkdirAll
• Exposure of sensitive data stored in other projects' documentation
• Potential for chaining toward code execution

Technical summary

The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath(), which strips leading/trailing slashes and the .md suffix but does not neutralize ../ traversal sequences, and internal/storage/doc_store.go then builds the target path with filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+.md) without verifying that the resolved path remains inside the documents directory.

Defensive priority

High priority for systems using knowns npm package version <= 0.29.1

Recommended defensive actions

• Upgrade knowns npm package to version 0.30.0 or later
• Verify that the Management API is authenticated and not bound to all interfaces
• Monitor for suspicious activity on the host filesystem
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the HTTP handler in internal/server/routes/docs.go not neutralizing ../ traversal sequences and internal/storage/doc_store.go building the target path without verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.