knowns versions prior to 0.30.0 contain a path‑traversal flaw in the POST /api/templates/preview endpoint. By supplying directory traversal sequences in the templateFile parameter, an unauthenticated attacker can bypass the intended path restrictions and read arbitrary files, including credentials and configuration data, that are returned in the JSON response. The vulnerability is a classic file‑disclosure weakness (CWE‑22).

The affected product is knowns from an open‑source project knowns‑dev. Any installation running knowns prior to version 0.30.0 is vulnerable because the POST /api/templates/preview route lacks proper path enforcement.

The CVSS score of 8.7 classifies the flaw as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, making the precise exploitation probability uncertain. The likely attack vector is unauthenticated HTTP requests to the API endpoint, with an attacker crafting a templateFile value that traverses directories. Successful exploitation would grant the attacker read access to sensitive files on the host, potentially compromising credentials or configuration information. The lack of authentication requirements makes the attack trivial for any user who can reach the endpoint.