---
id: CVE-2026-86538
title: >-
  knowns versions before 0.30.0 contain a path traversal vulnerability in the
  POST /api/templates/preview endpoint that allows unauthenticated attackers to
  read arbitrary files
summary: >-
  knowns versions before 0.30.0 contain a path traversal vulnerability in the
  POST /api/templates/preview endpoint that allows unauthenticated attackers to
  read arbitrary files. Attackers can supply directory traversal sequences in
  the tem…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
vendor: knowns-dev
product: knowns
affected:
  - knowns < 0.30.0
published: '2026-09-07'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T20:17:01.127'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86538'
references:
  - url: >-
      https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/server/routes/templates.go#L299-L310
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/knowns-dev/knowns/commit/09c5a96fd5817b941dc86669278c1a17db10ed4e
    label: disclosure@vulncheck.com
  - url: 'https://github.com/knowns-dev/knowns/releases/tag/v0.30.0'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/knowns-dev/knowns/security/advisories/GHSA-fpxv-c555-rhm3
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/knowns-before-0.30.0-path-traversal-via-templatefile-parameter
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00984
epssPercentile: 0.60751
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-14T19:21:55.276497Z'
ingestedAt: '2026-09-08T15:33:26.980Z'
---

## Overview

knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read sensitive files like credentials and configuration through the JSON response.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.