A critical path traversal vulnerability in the knowns template preview feature allows unauthenticated attackers to read sensitive system files, posing a severe risk to data confidentiality.

The application fails to properly sanitize the templateFile parameter within the POST /api/templates/preview endpoint, which permits directory traversal sequences. An unauthenticated attacker can exploit this flaw to bypass path restrictions and retrieve arbitrary files, including credentials and configuration data, via the JSON response.

Successful exploitation of this vulnerability allows unauthorized access to sensitive files residing on the server, which may include application secrets, database credentials, or system configuration files. Given the CVSS score of 7.5, this high-severity flaw could lead to full system compromise or facilitate further attacks by exposing internal environment details, causing significant reputational damage and operational disruption.

Immediate Action: Upgrade the knowns application to version 0.30.0 or later, as this release contains the necessary path validation fixes to prevent directory traversal.

Proactive Monitoring: Review web server access logs for anomalous requests to the /api/templates/preview endpoint, specifically looking for URL-encoded traversal patterns such as dot-dot-slash sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block incoming HTTP requests containing directory traversal sequences (e.g., ../) in request parameters.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk due to the lack of required authentication and the potential for sensitive data exposure. Administrators should prioritize updating to version 0.30.0 immediately to eliminate this attack vector. Until the patch is applied, ensure that the knowns instance is isolated from untrusted networks to minimize the risk of unauthorized access.