CVE-2026-86538

Name of the Vulnerable Software and Affected Versions knowns versions prior to 0.30.0

Description An issue exists where unauthenticated attackers can read arbitrary files by supplying directory traversal sequences in the templateFile parameter. This occurs via the 'POST /api/templates/preview' endpoint, allowing the retrieval of sensitive information such as credentials and configuration files through the JSON response. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations Update knowns to version 0.30.0 or later. Avoid using the templateFile parameter in the 'POST /api/templates/preview' endpoint until the update is applied.