CVE-2026-86538: knowns Unauthenticated Arbitrary File Read via templateFile
A template preview endpoint that reads whatever path you hand it and returns the contents in JSON is an arbitrary file read with a friendly name — and in knowns before 0.30.0 it needed no credentials.