knowns CVE-2026-86775

Default deployment of knowns where the Management API is unauthenticated and bound to all network interfaces (0.0.0.0) - this is explicitly described as the default configuration. No authentication, no special privileges, and no user interaction are required. Any network-reachable host can send a single HTTP request to the Document API (POST /api/docs or GET /api/docs/...) to trigger traversal. Exploitation is limited by the server-appended .md suffix on all file read/write operations; an attacker cannot read binary files or write files without the .md extension through this vector. Directory creation via os.MkdirAll carries no extension constraint. Deployments that restrict the Management API to localhost or enforce authentication at a reverse proxy layer are not exploitable remotely.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L) scoring 8.8 accurately reflects the threat model for default deployments: the Management API is unauthenticated and listens on all interfaces, making the flaw trivially exploitable from any network-reachable host. Confidentiality impact is constrained to Low because only .md files can be read, but integrity impact is High given arbitrary .md file creation and overwrite. Availability is Low rather than High because only .md files are directly deletable. The RCE tag in the input metadata reflects the chaining potential - the arbitrary-write primitive could be leveraged to overwrite documentation-adjacent configuration files or inject content processed by downstream tooling, though no direct code execution path is established by the description alone. No CISA KEV listing and no EPSS data were provided, indicating no confirmed active exploitation at time of analysis. The realistic risk is high for any internet-exposed knowns instance running the default unauthenticated configuration, but the product's limited deployment footprint (niche npm documentation tool) reduces population-level risk. The constraint to .md-suffixed files meaningfully limits the worst-case impact compared to an unconstrained write primitive.

An attacker identifies an internet-exposed knowns instance running the default configuration. The attacker sends POST /api/docs with body {"path": "../../../../etc/knowns_backdoor"} to write an attacker-controlled .md file into a sensitive directory, or sends GET /api/docs/../../../../home/app/.ssh/authorized_keys to read any world-readable .md file on the host. If the target system processes .md files through a template engine or documentation renderer that executes embedded directives, the write primitive may be chained to achieve code execution. No public exploit code has been confirmed at time of analysis.