Description

knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read sensitive files like credentials and configuration through the JSON response.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-07T23:16:53.443Z",
  "pubdate": "2026-09-07T23:16:53.443Z",
  "executiveSummary": "The knowns application, in versions prior to 0.30.0, contains a critical path traversal vulnerability within the /api/templates/preview endpoint. This security flaw allows unauthenticated remote attackers to bypass intended directory restrictions, enabling unauthorized read access to arbitrary files located on the underlying filesystem.\nThe vulnerability is characterized by improper input validation of the 'templateFile' parameter, which fails to sanitize directory traversal sequences (e.g., '../'). By manipulating this parameter, an attacker can traverse outside the designated directory scope to access sensitive system files, including configuration files, credential stores, or environment variables.\nThe impact of this vulnerability is severe, as it facilitates unauthorized information disclosure of sensitive data that can lead to complete system compromise. Since the endpoint does not require authentication, the attack vector is publicly accessible if the service is exposed to the network. Remediation requires updating the application to version 0.30.0 or later to ensure proper path sanitization and input validation are enforced.",
  "technicalDetails": "The vulnerability resides in the /api/templates/preview endpoint of the knowns application. The root cause is an insufficient validation mechanism applied to user-supplied input within the 'templateFile' parameter before it is utilized in filesystem operations. Specifically, the application fails to resolve and verify that the resulting file path remains within the intended, restricted directory structure.\nWhen an attacker submits a crafted POST request to /api/templates/preview, they can include directory traversal sequences such as '../' within the 'templateFile' parameter. For example, a payload targeting sensitive configuration files might look like 'templateFile=../../../../etc/passwd'. The application, lacking robust canonicalization or validation logic, treats this input as a legitimate path and proceeds to read the contents of the target file.\nThe attack flow proceeds as follows: First, the attacker identifies the /api/templates/preview endpoint, which accepts JSON payloads. Second, the attacker constructs a malicious payload where the 'templateFile' parameter contains the traversal string designed to navigate to sensitive areas of the filesystem. Third, the application processes this request without authenticating the user, thereby executing the file read operation with the privileges of the web service account. Fourth, the application retrieves the content of the target file and reflects this data back to the attacker within the JSON response body.\nThis vulnerability is particularly dangerous because it requires no prior authentication or administrative privileges, making it easily exploitable by any actor capable of reaching the web interface. The exposure of sensitive configuration files often provides attackers with credentials, API keys, database connection strings, or system-specific environment variables. With this information, an attacker can pivot from simple information disclosure to full system takeover or secondary attacks on connected infrastructure. The scope of the vulnerability is limited to knowns versions prior to 0.30.0, as subsequent versions include improved security controls to neutralize directory traversal attempts by validating that the final path matches the expected base directory."
}