CVE-2026-86538highexploração observadaCWE-22

CVE-2026-86538: falha de alta gravidade em knowns-dev knowns

knowns before 0.30.0 Path Traversal via templateFile parameter

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar knowns

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

43Vexday Risk Score

Priorize a correção. Ela exploração observada pelo VulnCheck.

ssvc Actcvss 8.7epss 1.0%
da publicação à arma
Publicada no NVD7 de set.
VulnCheck+10d
knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read sensitive files like credentials and configuration through the JSON response.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
knowns-dev · knowns
CVEs relacionadas — knowns-dev knowns

No mesmo produto, das mais perigosas para as menos.

CVE-2026-86439HIGHknowns before 0.30.0 Path Traversal via MCP doc and memory toolsEPSS 1.1%CVE-2026-86543CRITICALknowns before 0.30.0 Unauthenticated Management API ExposureEPSS 0.9%CVE-2026-88899CRITICALknowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory HeaderEPSS 0.8%CVE-2026-86541HIGHknowns before 0.30.0 Path Traversal via code.replace MCP actionEPSS 0.8%CVE-2026-86775HIGHknowns before 0.30.0 Path Traversal via Document APIEPSS 0.7%CVE-2026-86542HIGHknowns before 0.30.0 Path Traversal via Import NameEPSS 0.7%