The vulnerability arises from improper validation of the 'name' parameter in the import routes of knowns. Attackers who can send HTTP requests to the import endpoint can craft path traversal sequences that cause the server to write files outside the intended imports directory. This could allow the attacker to overwrite any file that is writable by the server process, including configuration files or scripts that the server later executes. The flaw is a classic directory traversal (CWE‑22) and results in uncapped write permissions.

Knowns versions earlier than 0.30.0 are affected. The earliest publicly available version referenced in the advisory is 0.29.1, and any release prior to the 0.30.0 tag carries the flaw. The product is the open‑source 'knowns' server developed by the knowns‑dev team. Admins running any such version should assess whether the import API is exposed to unauthenticated clients.

The CVSS score of 8.8 classifies the flaw as High severity, and the lack of an EPSS score does not indicate low exploitation probability, especially because the flaw is exploitable without authentication. Based on the description, an attacker could create or replace files that the server later processes, potentially leading to remote code execution if the overwritten file is a script or binary executed by the process. The vulnerability is not yet listed in CISA's KEV catalog, but the attack surface is large: anyone able to reach the import URL can supply a crafted name value.