knowns CVE-2026-86542

No special conditions are required beyond network access to the knowns server's import routes endpoint - the CVSS vector is AV:N/AC:L/PR:N/UI:N, meaning this is unauthenticated remote exploitation against any reachable knowns instance running a version before 0.30.0. The limiting factor is the server process's filesystem write permissions: only files and directories writable by the user account running knowns can be overwritten, so the practical impact depends on how the server is deployed (root vs. unprivileged service account). No authentication, non-default configuration, or special platform is required to trigger the traversal.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) assigns the highest possible accessibility - fully unauthenticated, network-reachable, no complexity or special conditions - which aligns with the description of an unvalidated HTTP parameter. The resulting score of 8.8 reflects VI:H and VA:H: an attacker can overwrite arbitrary server-writable files, disrupting service or potentially executing code by replacing scripts or configs. No KEV listing exists, no EPSS data was provided, and no public proof-of-concept code has been identified at time of analysis, meaning real-world exploitation priority should be moderated by the product's niche deployment footprint. Even so, the unauthenticated write primitive is straightforward enough that any internet-exposed knowns instance should be treated as urgent for remediation given the low exploitation complexity. The absent EPSS score and lack of KEV listing mean exploitation volume is currently unknown rather than confirmed low.

An unauthenticated attacker sends an HTTP request to the knowns import API endpoint with a crafted name parameter such as ../../etc/cron.d/backdoor, causing the server to write attacker-controlled content to an arbitrary path outside the imports directory. If the server runs with sufficient privileges, the attacker could overwrite a cron job, web application config, or startup script, achieving persistent code execution on the next scheduled execution or service restart. No public proof-of-concept code has been identified, but the advisory and referenced source lines make the attack straightforward to reproduce from the description alone.