{"id":20345,"date":"2026-09-10T00:32:31","date_gmt":"2026-09-09T16:32:31","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-86775"},"modified":"2026-09-10T00:32:31","modified_gmt":"2026-09-09T16:32:31","slug":"cve-2026-86775","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-86775","title":{"rendered":"CVE-2026-86775 [HIGH] &#8211; knowns (npm package) versions"},"content":{"rendered":"<p>knowns (npm package) versions &lt;= 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal\/server\/routes\/docs.go normalizes the user-supplied document path with cleanDocPath(), which strips leading\/trailing slashes and the .md suffix but does not neutralize ..\/ traversal sequences, and internal\/storage\/doc_store.go then builds the target path with filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+&quot;.md&quot;) without verifying that the resolved path remains inside the documents directory. In the default deployment, where the Management API is unauthenticated and bound to all interfaces, a remote unauthenticated attacker can supply a traversal payload (for example {&quot;path&quot;: &quot;..\/..\/..\/..\/tmp\/knowns_pwn_marker&quot;} to POST \/api\/docs, or an encoded path to GET \/api\/docs\/&#8230;) to read, create, overwrite, or delete arbitrary files with a .md extension anywhere on the host filesystem and to create arbitrary directories via os.MkdirAll. This can expose sensitive data stored in other projects&#039; documentation, corrupt or destroy files, and provide an arbitrary-write primitive that may be chained toward code execution. The issue is fixed in version 0.30.0.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>knowns (npm package) versions<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-20345","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/20345","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=20345"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=20345"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=20345"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}