CVE-2026-86542

Received Received - Intake

Path Traversal in Known Before 0.30.0

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description

knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the server process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-07

Generated

2026-09-08

AI Q&A

2026-09-08

EPSS Evaluated

N/A

NVD

CVE-2026-86542

EUVD

EUVD-2026-72560

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

The vulnerability exists in the knowns software before version 0.30.0. It fails to properly validate import names in the import routes, allowing unauthenticated attackers to write files outside the intended imports directory. Attackers can use directory traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files that the server process can write to.

Detection Guidance

To detect this vulnerability, inspect network traffic for requests to the import routes in versions before 0.30.0. Look for file write operations with traversal sequences in the name parameter, such as '../' or similar patterns. Check server logs for unauthorized file modifications outside the intended imports directory.

Impact Analysis

This vulnerability allows attackers to overwrite critical files on the server, potentially leading to remote code execution, data corruption, or denial of service. Sensitive data could be exposed or modified, and the system's integrity could be compromised.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, violating data integrity and confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to potential data breaches or unauthorized access to protected health or personal information.

Mitigation Strategies

Upgrade the affected software to version 0.30.0 or later to address the file validation issue in import routes.

Hi! I’m here to help you understand CVE-2026-86542. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70