CVE-2026-86775

Name of the Vulnerable Software and Affected Versions knowns (npm package) versions prior to 0.30.0

Description A path traversal issue exists in the Document API. The HTTP handler in internal/server/routes/docs.go uses the cleanDocPath() function to normalize user-supplied paths, but it fails to neutralize ../ traversal sequences. Subsequently, internal/storage/doc store.go constructs the target path using filepath.Join() without verifying that the resulting path remains within the intended documents directory. In default deployments where the Management API is unauthenticated and bound to all interfaces, a remote unauthenticated attacker can use traversal payloads via the /api/docs endpoint or the /api/docs/... path to read, create, overwrite, or delete arbitrary files with a .md extension on the host filesystem. Additionally, the os.MkdirAll() function can be used to create arbitrary directories. This may lead to the exposure of sensitive data, file corruption, or potential code execution through an arbitrary-write primitive. The vulnerable parameter is path.

Recommendations Update knowns (npm package) to version 0.30.0.