CVE-2026-86542: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in knowns-dev knowns

The knowns-dev knowns software prior to version 0.30.0 contains an improper limitation of a pathname to a restricted directory vulnerability (CWE-22). Specifically, the import routes do not validate the 'name' parameter correctly, enabling unauthenticated attackers to supply path traversal sequences to escape the imports directory. This allows attackers to write arbitrary files outside the imports directory, potentially overwriting files writable by the server process.

Successful exploitation allows unauthenticated attackers to write arbitrary files outside the intended imports directory, potentially overwriting critical files writable by the server process. This can lead to significant security risks including code execution or system compromise depending on the files overwritten.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict file system permissions to limit writable files by the server process and monitor for suspicious file modifications related to import routes.