---
id: CVE-2026-86775
title: >-
  knowns (npm package) versions <= 0.29.1 contain a path traversal vulnerability
  in the Document API
summary: >-
  knowns (npm package) versions <= 0.29.1 contain a path traversal vulnerability
  in the Document API. The HTTP handler in internal/server/routes/docs.go
  normalizes the user-supplied document path with cleanDocPath(), which strips
  leading/t…
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L'
cwe:
  - CWE-22
vendor: knowns-dev
product: knowns
affected:
  - knowns < 0.30.0
published: '2026-09-09'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T14:17:17.037'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86775'
references:
  - url: >-
      https://github.com/knowns-dev/knowns/security/advisories/GHSA-3h35-4jq7-hv45
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/knowns-before-0.30.0-path-traversal-via-document-api
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-14T13:32:50.265023Z'
epss: 0.00747
epssPercentile: 0.52825
ingestedAt: '2026-09-14T15:23:07.419Z'
---

## Overview

knowns (npm package) versions <= 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath(), which strips leading/trailing slashes and the .md suffix but does not neutralize ../ traversal sequences, and internal/storage/doc_store.go then builds the target path with filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+".md") without verifying that the resolved path remains inside the documents directory. In the default deployment, where the Management API is unauthenticated and bound to all interfaces, a remote unauthenticated attacker can supply a traversal payload (for example {"path": "../../../../tmp/knowns_pwn_marker"} to POST /api/docs, or an encoded path to GET /api/docs/...) to read, create, overwrite, or delete arbitrary files with a .md extension anywhere on the host filesystem and to create arbitrary directories via os.MkdirAll. This can expose sensitive data stored in other projects' documentation, corrupt or destroy files, and provide an arbitrary-write primitive that may be chained toward code execution. The issue is fixed in version 0.30.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.