---
id: CVE-2026-88937
title: knowns through 0.33.0 Path Traversal via Template Engine
summary: >-
  knowns through 0.33.0 fails to properly validate template destination paths in
  the code generation template engine, allowing attackers to read and write
  arbitrary files outside the project root. Attackers can supply malicious
  templates t…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-22
vendor: knowns-dev
product: knowns
affected:
  - knowns <= 0.33.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T16:02:56.560540Z'
exploitAvailable: true
published: '2026-09-10'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T11:07:58.413Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-88937'
references:
  - url: >-
      https://github.com/knowns-dev/knowns/security/advisories/GHSA-68cq-4rwm-f7jr
    label: GitHub Security Advisory (GHSA-68cq-4rwm-f7jr)
  - url: >-
      https://github.com/knowns-dev/knowns/security/advisories/GHSA-xjcg-5j3r-m6f9
    label: GitHub Security Advisory (GHSA-xjcg-5j3r-m6f9)
  - url: >-
      https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/codegen/template_engine.go#L625-L636
  - url: >-
      https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/codegen/template_engine.go#L318-L344
  - url: >-
      https://www.vulncheck.com/advisories/knowns-through-0.33.0-path-traversal-via-template-engine
    label: >-
      VulnCheck Advisory: knowns through 0.33.0 Path Traversal via Template
      Engine
tags:
  - cve.org
  - exploit-available
epss: 0.00517
epssPercentile: 0.43
ingestedAt: '2026-09-11T16:45:47.922Z'
---

## Overview

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal credentials, or achieve persistent code execution on victim systems.

## Affected

- `knowns <= 0.33.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.