knowns CVE-2026-86538

No special configuration or authentication is required. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms unauthenticated remote exploitation against any default deployment of knowns before v0.30.0 where the API is network-accessible. The attacker need only know the endpoint path (/api/templates/preview) and parameter name (templateFile). Exploitation is bounded by the OS-level read permissions of the user running the knowns process - files owned by other users with restrictive permissions (e.g., root-only readable secrets) may not be retrievable, but application-layer secrets such as database URIs, API tokens, and TLS private keys stored in the application directory are typically readable by the application process and therefore directly exfiltrable.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N accurately characterizes the threat: the endpoint requires no authentication and is reachable over the network with no preconditions, delivering high confidentiality impact through a direct file-read primitive. EPSS data is not available in the provided input, so exploitation probability beyond the CVSS signal cannot be quantified. No CISA KEV listing is present, and no public proof-of-concept is confirmed - however, the attack primitive (path traversal returning file content in JSON) is one of the most commonly and easily reproduced vulnerability classes. Even a mid-sized municipal IT team in mielec running an internet-exposed knowns instance should treat this as an urgent upgrade, given the zero-authentication, zero-complexity exploitation path and the direct credential-exfiltration outcome. The primary limiting factor for real-world risk is the niche deployment footprint of the knowns project itself - wide exposure is unlikely, but any exposed instance is fully compromisable at the confidentiality level.

An unauthenticated attacker sends a crafted POST /api/templates/preview request with templateFile=../../../../etc/passwd (or targeting application credential files such as .env or database config) to a network-reachable knowns instance below v0.30.0. The server reads the target file without path validation and returns its contents embedded in the JSON response body. No exploit tooling is confirmed public, but standard HTTP clients (curl, Burp Suite) are sufficient to execute this attack.